Rule Library

Sigma Rules

1 rule found for "jmallette"

3,707Total

3,116Detection

451Emerging

137Hunting

Filters

Type

Severity

Status

Product

Category

Detectionhightest

Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

Detects usage of cmdkey to look for cached credentials on the system

WindowsProcess Creation

TA0006 · Credential AccessT1003.005 · Cached Domain Credentials

jmallette+2Wed Jan 16windows