Rule Info
Name
New Generic Credentials Added Via Cmdkey.EXE
Author
frack113, Nasreddine Bencherchali (Nextron Systems)
Description
Detects usage of "cmdkey.exe" to add generic credentials.
As an example, this can be used before connecting to an RDP session via command line interface.
Date
2023-02-03 00:00:00
Modified
2024-03-05 00:00:00
Id
b1ec66c6-f4d1-4b5c-96dd-af28ccae7727
Tags
attack.credential_access attack.t1003.005 DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
frack113
Merge PR #4752 from @frack113 - Update rules to use the `windash` modifier
2024-03-11
Qasim Qlf
Merge PR #4728 from @qasimqlf - Update multiple rules to cover the '-' arguments along with '/' arguments
2024-02-26
github-actions[bot]
Merge PR #4611 from @nasbench - Promote Older Rules Status From `experimental` To `test`
2023-12-01
Nasreddine Bencherchali
fix: add missing modified and small fixes to selections
2023-02-04
Scan your endpoints, forensic images or collected files with our portable scanner THOR