huntrule

Windows Process Creation: DeviceCredentialDeployment.exe Execution

Flags Windows process execution when DeviceCredentialDeployment.exe starts.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: DeviceCredentialDeployment.exe Execution"
id: 74163189-85f0-4f5d-a5e2-721fbeeabf3d
status: test
description: This rule detects execution of DeviceCredentialDeployment.exe on Windows based on process creation events. Attackers may use this binary to manipulate how processes are presented or hidden to reduce visibility during malicious activity. The detection relies on process creation telemetry that includes the executed image path or filename.
references:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/147
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_device_credential_deployment.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-19
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \DeviceCredentialDeployment.exe
  condition: selection
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: b8b1b304-a60f-4999-9a6e-c547bde03ffd
    type: derived

What it detects

This rule detects execution of DeviceCredentialDeployment.exe on Windows based on process creation events. Attackers may use this binary to manipulate how processes are presented or hidden to reduce visibility during malicious activity. The detection relies on process creation telemetry that includes the executed image path or filename.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.