New Generic Credentials Added Via Cmdkey.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP session via command line interface.

Known false positives

Legitimate usage for administration purposes

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.005` OS Credential Dumping: Cached Domain Credentials

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: New Generic Credentials Added Via Cmdkey.EXE
id: b1ec66c6-f4d1-4b5c-96dd-af28ccae7727
status: test
description: |
    Detects usage of "cmdkey.exe" to add generic credentials.
    As an example, this can be used before connecting to an RDP session via command line interface.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2023-02-03
modified: 2024-03-05
tags:
    - attack.credential-access
    - attack.t1003.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\cmdkey.exe'
        - OriginalFileName: 'cmdkey.exe'
    selection_cli_generic:
        CommandLine|contains|windash: ' -g' # Generic
    selection_cli_user:
        CommandLine|contains|windash: ' -u' # User
    selection_cli_password:
        CommandLine|contains|windash: ' -p' # Password
    condition: all of selection_*
falsepositives:
    - Legitimate usage for administration purposes
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds/info.yml
simulation:
    - type: atomic-red-team
      name: RDP to DomainController
      technique: T1021.001
      atomic_guid: 355d4632-8cb9-449d-91ce-b566d0253d3e

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\cmdkey.exe'
    - OriginalFileName: 'cmdkey.exe'

Stage 2: `selection_cli_generic`

selection_cli_generic:
    CommandLine|contains|windash: ' -g'

Stage 3: `selection_cli_user`

selection_cli_user:
    CommandLine|contains|windash: ' -u'

Stage 4: `selection_cli_password`

selection_cli_password:
    CommandLine|contains|windash: ' -p'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-g` transforms: `windash` corpus 2 (sigma 2) `-p` transforms: `windash` corpus 4 (sigma 4) `-u` transforms: `windash` corpus 2 (sigma 1, splunk 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\cmdkey.exe` corpus 3 (sigma 3)	`field:"Image" kind:ends_with value:"\cmdkey.exe"`
`OriginalFileName`	eq	`cmdkey.exe` corpus 6 (splunk 3, sigma 2, elastic 1)	`field:"OriginalFileName" kind:eq value:"cmdkey.exe"`