Elastic Defend high stable eql

Access to Windows Passwords Vault via Powershell

Identifies access attempt to the Windows Passwords Vault via Powershell commands. Adversaries may acquire credentials from Vault files.

View Source

Detection Logic

process where event.action == "start" and
 process.pe.original_file_name == "PowerShell.EXE" and
 process.command_line : ("*Credentials.PasswordVault*", "*RetrievePassword*", "*Credentials*RetrieveAll*") and
 not process.parent.executable :
          ("?:\\Program Files\\WindowsApps\\KeeperSecurityInc.KeeperPasswordManager_*\\app\\keeperpasswordmanager.exe",
           "?:\\Program Files (x86)\\WindowsApps\\KeeperSecurityInc.KeeperPasswordManager_*\\app\\keeperpasswordmanager.exe") and
 not (process.parent.code_signature.subject_name == "Keeper Security Inc." and process.parent.code_signature.trusted == true)

Field Validations

Loading…

Comments (0)

Loading comments...