Windows: Password Change via ksetup.exe SetComputerPassword

title: "Windows: Password Change via ksetup.exe SetComputerPassword"
id: 905537ae-a196-4599-ae86-716e3a6acb8f
status: test
description: This rule flags execution of ksetup.exe where the command line contains the /setcomputerpassword parameter, indicating a computer account or host principal password change. Attackers may use this capability to alter authentication material for accounts tied to the host, potentially impacting access to domain resources. Detection relies on Windows process creation telemetry, specifically the image name and the command-line string contents.
references:
  - https://twitter.com/Oddvarmoe/status/1641712700605513729
  - https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ksetup_password_change_computer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-06
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \ksetup.exe
    - OriginalFileName: ksetup.exe
  selection_cli:
    CommandLine|contains: " /setcomputerpassword "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: de16d92c-c446-4d53-8938-10aeef41c8b6
    type: derived