Skip to content

refactor(rules): Improve Credential discovery via VaultCmd tool rule #502

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rabbitstack merged 1 commit into from
Apr 25, 2025
Merged

refactor(rules): Improve Credential discovery via VaultCmd tool rule #502

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 9 additions & 10 deletions rules/credential_access_credential_discovery_via_vaultcmd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
name: Credential discovery via VaultCmd.exe
name: Credential discovery via VaultCmd tool
id: 2ce607d3-5a14-4628-be8a-22bcde97dab5
version: 1.0.1
version: 1.1.0
description: |
Detects the usage of the VaultCmd tool to list Windows Credentials.
VaultCmd creates, displays and deletes stored credentials.
Detects the usage of the VaultCmd tool to list Windows Credentials. VaultCmd creates,
displays and deletes stored credentials. An adversary may abuse this to list or dump
credentials stored in the Credential Manager.
labels:
tactic.id: TA0006
tactic.name: Credential Access
Expand All @@ -16,12 +17,10 @@ labels:
subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/

condition: >
spawn_process and ps.child.name ~= 'VaultCmd.exe'
spawn_process and (ps.child.name ~= 'VaultCmd.exe' or ps.child.pe.file.name ~= 'vaultcmd.exe')
and
ps.child.args in
(
'"/listcreds:Windows Credentials"',
'"/listcreds:Web Credentials"'
)
ps.child.cmdline imatches '*/list*'

severity: medium

min-engine-version: 2.0.0