Windows: Logged-On User Password Change via ksetup.exe

title: "Windows: Logged-On User Password Change via ksetup.exe"
id: d687615b-bbaa-429f-abd1-bcd55b131979
status: test
description: This rule identifies process executions of ksetup.exe where the command line includes the /ChangePassword argument. Attackers and administrators may use this utility to change account credentials, making such activity relevant for detecting unauthorized password changes. It relies on Windows process creation telemetry, matching the executable by image path or original file name and filtering by the /ChangePassword command-line parameter.
references:
  - https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ksetup_password_change_user.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-06
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \ksetup.exe
    - OriginalFileName: ksetup.exe
  selection_cli:
    CommandLine|contains: " /ChangePassword "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: c9783e20-4793-4164-ba96-d9ee483992c4
    type: derived