SigmaHQ/rules/windows/sysmon/sysmon_cmdkey_recon.yml

title: cmdkey Cached Credentials Recon
status: experimental
description: Detects usage of cmdkey to look for cached credentials.
reference: 
    - https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
    - https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx
author: jmallette
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        Image: '*\cmdkey.exe'
        CommandLine: '* /list *'
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
    - User
falsepositives:
    - Legitimate administrative tasks.
level: low