Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

Title: Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
Status: test
Description:Detects usage of cmdkey to look for cached credentials on the system
References:
  -https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
  -https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx
  -https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey
Author: jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2019-01-16
modified:2024-03-05
Tags:

• -'attack.credential-access'
• -'attack.t1003.005'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\cmdkey.exe' OriginalFileName:'cmdkey.exe'   selection_cli:
    CommandLine|contains|windash: ' -l'
  condition:all of selection*
Falsepositives:
  -Legitimate administrative tasks
Level: high