Windows Rundll32 Key Manager Launch (keymgr KRShowKeyMgr) Credential Access
Alerts on rundll32 launching the Windows Key Manager (keymgr / KRShowKeyMgr), a potential credential access step.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-04-21
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where rundll32.exe is invoked with command-line arguments that include keymgr and KRShowKeyMgr, which opens the Windows Stored User Names and Passwords (Key Manager) interface. Attackers may use this to access or expose stored credentials from the Key Manager context. The detection relies on Windows process creation telemetry, matching the image name/path and required command-line substrings.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Rundll32 Key Manager Launch (keymgr KRShowKeyMgr) Credential Access
id: cb9ec72c-1d7e-4dbf-926e-98d90f7928f6
status: test
description: This rule flags process executions where rundll32.exe is invoked with command-line arguments that include keymgr and KRShowKeyMgr, which opens the Windows Stored User Names and Passwords (Key Manager) interface. Attackers may use this to access or expose stored credentials from the Key Manager context. The detection relies on Windows process creation telemetry, matching the image name/path and required command-line substrings.
references:
- https://twitter.com/NinjaParanoid/status/1516442028963659777
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_keymgr.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-21
modified: 2023-02-09
tags:
- attack.credential-access
- attack.t1555.004
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \rundll32.exe
- OriginalFileName: RUNDLL32.EXE
selection_cli:
CommandLine|contains|all:
- keymgr
- KRShowKeyMgr
condition: all of selection_*
falsepositives:
- Administrative activity
level: high
license: DRL-1.1
related:
- id: a4694263-59a8-4608-a3a0-6f8d3a51664c
type: derived