May this cmd for password query could find into a content update?

RFeyertag — Sat, 03 Dec 2022 22:25:35 GMT

https://twitter.com/VirtualAllocEx/status/1599048829084794880?s=20&t=V1OyrvuCbhYez-wkSXNk1A

Or ist there a rule ready for this?

Rob

Re: May this cmd for password query could find into a content update?

mavraham — Sun, 04 Dec 2022 19:24:57 GMT

Dear @RFeyertag

Thank you for writing to XDR live community!

You can create your own custom BIOC rule to detect this attempt to discover unsecured credentials in the registry.

Start by logging in to your XDR tenant and Choose Detection Rules → BIOC
In the BIOC rules page choose ‘add BIOC’ at the top right of your screen.
Next, select to create a Process based BIOC and apply the following filters:

name = reg.exe
cmd =~.*query.*password.*

Click ‘Save’.
You will now be prompted to name your new BIOC rule and, choose: type, severity level and associated MITRE techniques and tactics:

Type:‘Credentials Access’.
Technique:T1214 - Credentials in Registry
Tactic: TA0006 - Credential Access

Click save.

Attaching screenshots below for your convenience .
You should now have a custom BIOC to help you discover potential attempts to unsecure credentials in the registry.

Hope this helps!

topic May this cmd for password query could find into a content update? in Cortex XDR Discussions

May this cmd for password query could find into a content update?

Re: May this cmd for password query could find into a content update?