Suspicious Computer Machine Password by PowerShell (via ps_module)

title: Suspicious Computer Machine Password by PowerShell (via ps_module)
id: d2a190d7-4024-5709-a52a-3dc46c750323
status: stable
description: This rule detects the Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.
references:
    - https://attack.mitre.org/techniques/T1078/
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1
    - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
author: Huntrule Team
date: 2026-02-03
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection:
        ContextInfo|contains: 'Reset-ComputerMachinePassword'
    condition: selection
falsepositives:
    - Unknown
level: medium