User Account Password Property Manipulation Via WMIC

Swachchhanda Shrawan Poudel, Christian Burkard

Detects manipulation of password-related properties on user accounts via WMIC against the Win32_UserAccount class. This covers direct password changes as well as policy modifications such as disabling password expiry or preventing password changes, all common persistence techniques to maintain access to a backdoor account.

2026-07-01 00:00:00

None

7e4c2b9a-1d38-4f5e-a7c6-9b0d3e81f247

attack.persistence attack.privilege-escalation attack.t1098

Nextron Sigma feed only (private)