Windows: cmdkey.exe Adds Generic Credentials via Command-Line Flags

Flags -g/-u/-p with cmdkey.exe indicate generic credential insertion, which can enable follow-on access.

FreeUnreviewedSigmamediumv1

windows-cmdkey-exe-adds-generic-credentials-via-command-line-flags-b1ec66c6

title: "Windows: cmdkey.exe Adds Generic Credentials via Command-Line Flags"
id: 27722a5e-72bc-40f9-9d52-6584c4718f5e
status: test
description: This rule identifies Windows process creation events where cmdkey.exe is used with command-line parameters for adding generic credentials, including -g, -u, and -p. Attackers can use cmdkey to pre-stage credentials for later access, reducing the need to prompt for or supply credentials interactively. Telemetry required includes process creation details such as Image/OriginalFileName and CommandLine content containing the expected flags.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-03
modified: 2024-03-05
tags:
  - attack.credential-access
  - attack.t1003.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cmdkey.exe
    - OriginalFileName: cmdkey.exe
  selection_cli_generic:
    CommandLine|contains|windash: " -g"
  selection_cli_user:
    CommandLine|contains|windash: " -u"
  selection_cli_password:
    CommandLine|contains|windash: " -p"
  condition: all of selection_*
falsepositives:
  - Legitimate usage for administration purposes
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds/info.yml
simulation:
  - type: atomic-red-team
    name: RDP to DomainController
    technique: T1021.001
    atomic_guid: 355d4632-8cb9-449d-91ce-b566d0253d3e
license: DRL-1.1
related:
  - id: b1ec66c6-f4d1-4b5c-96dd-af28ccae7727
    type: derived

What it detects

This rule identifies Windows process creation events where cmdkey.exe is used with command-line parameters for adding generic credentials, including -g, -u, and -p. Attackers can use cmdkey to pre-stage credentials for later access, reducing the need to prompt for or supply credentials interactively. Telemetry required includes process creation details such as Image/OriginalFileName and CommandLine content containing the expected flags.

Known false positives

Legitimate usage for administration purposes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.