credential_access_credential_access_from_backups_via_rundll32.yml

name: Credentials access from backups via Rundll32
id: ff43852c-486c-4870-a318-ce976d2231a5
version: 1.0.0
description: |
  Detects an attempt to obtain credentials from credential backups.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1555
  technique.name: Credentials from Password Stores
  technique.ref: https://attack.mitre.org/techniques/T1555/
  subtechnique.id: T1555.004
  subtechnique.name: Windows Credential Manager
  subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/

condition: >
  spawn_process
    and
  (ps.child.name ~= 'rundll32.exe' or ps.child.pe.file.name ~= 'rundll32.exe')
    and
  (ps.child.args iin ('keymgr.dll') and ps.child.args iin ('KRShowKeyMgr'))

min-engine-version: 2.0.0