Detection rules › Sigma

Suspicious Computer Machine Password by PowerShell

Severity
medium
Author
frack113
Source
upstream

The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1078 Valid Accounts
PersistenceT1078 Valid Accounts
Privilege EscalationT1078 Valid Accounts
Defense EvasionT1078 Valid Accounts

Event coverage

ProviderEvent IDTitle
PowerShell4103Payload Context: ContextInfo User Data: UserData.

Stages and Predicates

Stage 1: selection

ContextInfo|contains: Reset-ComputerMachinePassword

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ContextInfomatch
  • Reset-ComputerMachinePassword