huntrule

Windows Rundll32 Key Manager Launch (keymgr KRShowKeyMgr) Credential Access

Alerts on rundll32 launching the Windows Key Manager (keymgr / KRShowKeyMgr), a potential credential access step.

FreeUnreviewedSigmahighv1
title: Windows Rundll32 Key Manager Launch (keymgr KRShowKeyMgr) Credential Access
id: cb9ec72c-1d7e-4dbf-926e-98d90f7928f6
status: test
description: This rule flags process executions where rundll32.exe is invoked with command-line arguments that include keymgr and KRShowKeyMgr, which opens the Windows Stored User Names and Passwords (Key Manager) interface. Attackers may use this to access or expose stored credentials from the Key Manager context. The detection relies on Windows process creation telemetry, matching the image name/path and required command-line substrings.
references:
  - https://twitter.com/NinjaParanoid/status/1516442028963659777
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_keymgr.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-21
modified: 2023-02-09
tags:
  - attack.credential-access
  - attack.t1555.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  selection_cli:
    CommandLine|contains|all:
      - keymgr
      - KRShowKeyMgr
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: high
license: DRL-1.1
related:
  - id: a4694263-59a8-4608-a3a0-6f8d3a51664c
    type: derived

What it detects

This rule flags process executions where rundll32.exe is invoked with command-line arguments that include keymgr and KRShowKeyMgr, which opens the Windows Stored User Names and Passwords (Key Manager) interface. Attackers may use this to access or expose stored credentials from the Key Manager context. The detection relies on Windows process creation telemetry, matching the image name/path and required command-line substrings.

Known false positives

  • Administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.