Windows CLI Processes Using Common Weak or Abused Passwords
Alerts when Windows command lines include common weak or reused password values.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-14
- Updated
- 2026-07-30
What it detects
This rule flags Windows process executions where the command line contains well-known weak or commonly reused password strings. Attackers may use inline credentials when creating or modifying accounts or attempting remote access, making this behavior a useful signal for credential exposure and poor operational hygiene. Detection relies on process creation telemetry, specifically the command-line text captured at process start.
Reporting behind it
- symantec-enterprise-blogs.security.comhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments
- thedfirreport.comhttps://thedfirreport.com/2022/09/26/bumblebee-round-two/
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/
- huntress.comhttps://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_weak_or_abused_passwords.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-cli-processes-using-common-weak-or-abused-passwords-91edcfb1
title: Windows CLI Processes Using Common Weak or Abused Passwords
id: f32c3bad-e9e3-4a61-b420-53e5d91672bf
status: test
description: This rule flags Windows process executions where the command line contains well-known weak or commonly reused password strings. Attackers may use inline credentials when creating or modifying accounts or attempting remote access, making this behavior a useful signal for credential exposure and poor operational hygiene. Detection relies on process creation telemetry, specifically the command-line text captured at process start.
references:
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments
- https://thedfirreport.com/2022/09/26/bumblebee-round-two/
- https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/
- https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_weak_or_abused_passwords.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-14
modified: 2024-02-23
tags:
- attack.execution
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- "123456789"
- 123123qwE
- Asd123.aaaa
- Decryptme
- P@ssw0rd!
- Pass8080
- password123
- test@202
condition: selection
falsepositives:
- Legitimate usage of the passwords by users via commandline (should be discouraged)
- Other currently unknown false positives
level: medium
license: DRL-1.1
related:
- id: 91edcfb1-2529-4ac2-9ecc-7617f895c7e4
type: derived