Windows Password Change via ksetup.exe /setcomputerpassword
Alerts on Windows ksetup.exe executions that set a computer password via /setcomputerpassword.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-04-06
- Updated
- 2026-07-31
What it detects
This rule flags process executions of ksetup.exe where the command line includes the /setcomputerpassword argument, indicating a computer or domain host principal password change. Attackers may use this capability to alter authentication material for a host identity, potentially enabling persistence or access as the affected principal. The detection relies on Windows process creation telemetry, matching the executable by image name and OriginalFileName and the specific command-line parameter.
Reporting behind it
- twitter.comhttps://twitter.com/Oddvarmoe/status/1641712700605513729
- learn.microsoft.comhttps://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ksetup_password_change_computer.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-password-change-via-ksetup-exe-setcomputerpassword-de16d92c
title: Windows Password Change via ksetup.exe /setcomputerpassword
id: 905537ae-a196-4599-ae86-716e3a6acb8f
status: test
description: This rule flags process executions of ksetup.exe where the command line includes the /setcomputerpassword argument, indicating a computer or domain host principal password change. Attackers may use this capability to alter authentication material for a host identity, potentially enabling persistence or access as the affected principal. The detection relies on Windows process creation telemetry, matching the executable by image name and OriginalFileName and the specific command-line parameter.
references:
- https://twitter.com/Oddvarmoe/status/1641712700605513729
- https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ksetup_password_change_computer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-04-06
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \ksetup.exe
- OriginalFileName: ksetup.exe
selection_cli:
CommandLine|contains: " /setcomputerpassword "
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: de16d92c-c446-4d53-8938-10aeef41c8b6
type: derived