rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml

title: Cmdkey Cached Credentials Recon
id: 07f8bdc2-c9b3-472a-9817-5a670b872f53
status: experimental
description: Detects usage of cmdkey to look for cached credentials
references:
    - https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
    - https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx
author: jmallette
date: 2019/01/16
modified: 2021/07/07
tags:
    - attack.credential_access
    - attack.t1003.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\cmdkey.exe'
        CommandLine|contains: ' /list'
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
    - User
falsepositives:
    - Legitimate administrative tasks
level: medium
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`title: Cmdkey Cached Credentials Recon`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 07f8bdc2-c9b3-472a-9817-5a670b872f53`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`status: experimental`
			`description: Detects usage of cmdkey to look for cached credentials`
			`references:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`- https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation`
			`- https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`author: jmallette`
fix: fixed missing date fields in remaining files 2020-01-30 16:07:37 +01:00			`date: 2019/01/16`
refactor: changed cmdkey rule 2021-07-07 14:45:03 +02:00			`modified: 2021/07/07`
Missing tags 2019-03-06 00:02:37 +01:00			`tags:`
			`- attack.credential_access`
Initial round of subtechnique updates 2020-06-16 14:46:08 -06:00			`- attack.t1003.005`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`logsource:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`category: process_creation`
			`product: windows`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`detection:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`selection:`
Update win_cmdkey_recon.yml 2020-10-15 17:46:14 -03:00			`Image\|endswith: '\cmdkey.exe'`
refactor: changed cmdkey rule 2021-07-07 14:45:03 +02:00			`CommandLine\|contains: ' /list'`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`condition: selection`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`fields:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`- CommandLine`
			`- ParentCommandLine`
			`- User`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`falsepositives:`
refactor: changed cmdkey rule 2021-07-07 14:45:03 +02:00			`- Legitimate administrative tasks`
			`level: medium`