Windows CLI Processes Using Common Weak or Abused Passwords

Alerts when Windows command lines include common weak or reused password values.

FreeUnreviewedSigmamediumv1

windows-cli-processes-using-common-weak-or-abused-passwords-91edcfb1

title: Windows CLI Processes Using Common Weak or Abused Passwords
id: f32c3bad-e9e3-4a61-b420-53e5d91672bf
status: test
description: This rule flags Windows process executions where the command line contains well-known weak or commonly reused password strings. Attackers may use inline credentials when creating or modifying accounts or attempting remote access, making this behavior a useful signal for credential exposure and poor operational hygiene. Detection relies on process creation telemetry, specifically the command-line text captured at process start.
references:
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
  - https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_weak_or_abused_passwords.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-14
modified: 2024-02-23
tags:
  - attack.execution
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - "123456789"
      - 123123qwE
      - Asd123.aaaa
      - Decryptme
      - P@ssw0rd!
      - Pass8080
      - password123
      - test@202
  condition: selection
falsepositives:
  - Legitimate usage of the passwords by users via commandline (should be discouraged)
  - Other currently unknown false positives
level: medium
license: DRL-1.1
related:
  - id: 91edcfb1-2529-4ac2-9ecc-7617f895c7e4
    type: derived

What it detects

This rule flags Windows process executions where the command line contains well-known weak or commonly reused password strings. Attackers may use inline credentials when creating or modifying accounts or attempting remote access, making this behavior a useful signal for credential exposure and poor operational hygiene. Detection relies on process creation telemetry, specifically the command-line text captured at process start.

Known false positives

Legitimate usage of the passwords by users via commandline (should be discouraged)
Other currently unknown false positives

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.