Windows: Logged-On User Password Change via ksetup.exe
Flags ksetup.exe executions with /ChangePassword that may indicate a logged-on user password change on Windows.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-06
- Updated
- 2026-07-31
What it detects
This rule identifies password change activity where the process image is ksetup.exe and the command line includes the /ChangePassword parameter for the logged-on user context. Attackers may use native Windows utilities to make credential changes while blending into legitimate administrative behavior. The detection relies on process creation telemetry, specifically the executed executable name/path and the command-line content indicating a password change.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-logged-on-user-password-change-via-ksetup-exe-c9783e20
title: "Windows: Logged-On User Password Change via ksetup.exe"
id: d687615b-bbaa-429f-abd1-bcd55b131979
status: test
description: This rule identifies password change activity where the process image is ksetup.exe and the command line includes the /ChangePassword parameter for the logged-on user context. Attackers may use native Windows utilities to make credential changes while blending into legitimate administrative behavior. The detection relies on process creation telemetry, specifically the executed executable name/path and the command-line content indicating a password change.
references:
- https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ksetup_password_change_user.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-06
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \ksetup.exe
- OriginalFileName: ksetup.exe
selection_cli:
CommandLine|contains: " /ChangePassword "
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: c9783e20-4793-4164-ba96-d9ee483992c4
type: derived