Windows PowerShell: Reset-ComputerMachinePassword Computer Account Password Changes

Detects PowerShell executions of Reset-ComputerMachinePassword that may indicate attempts to alter domain computer account authentication.

FreeUnreviewedSigmamediumv1

windows-powershell-reset-computermachinepassword-computer-account-password-chang-e3818659

title: "Windows PowerShell: Reset-ComputerMachinePassword Computer Account Password Changes"
id: 7a3def67-0fd9-4321-997b-72fa73896b78
status: test
description: This rule flags PowerShell activity that invokes the Reset-ComputerMachinePassword command. Changing the computer account password can enable persistence or assist privilege escalation by altering how a host authenticates to domain controllers. The detection relies on PowerShell telemetry that includes the executed command text via ContextInfo, matching on the command name.
references:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_susp_reset_computermachinepassword.yml
author: frack113, Huntrule Team
date: 2022-02-21
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    ContextInfo|contains: Reset-ComputerMachinePassword
  condition: selection
falsepositives:
  - Administrator PowerShell scripts
level: medium
license: DRL-1.1
related:
  - id: e3818659-5016-4811-a73c-dde4679169d2
    type: derived

What it detects

This rule flags PowerShell activity that invokes the Reset-ComputerMachinePassword command. Changing the computer account password can enable persistence or assist privilege escalation by altering how a host authenticates to domain controllers. The detection relies on PowerShell telemetry that includes the executed command text via ContextInfo, matching on the command name.

Known false positives

Administrator PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.