KQL Search

// High-Risk assets with command line credentials

// DefenderXDR’s critical asset management uses behavior-based logic to automatically identify assets of interest. However, there may be instances where not all relevant assets are detected. In this post, I will share a KQL query to identify servers and workstations that frequently run command line commands with username/password parameters. These systems often store administrative credentials due to command line execution. If compromised, the blast radius could be significant, as stored credentials could be exposed, accelerating lateral movement attacks. SecOps should run this KQL query to identify device names and create a new classification in DefenderXDR’s critical management, tagging these devices as high criticality. This ensures that when an incident or alert is triggered, correlations can be made quickly, leading to faster triaging and containment.

// High-Risk assets with command line credentials

let MonitoredCommands = dynamic(['net', 'wmic', 'schtasks', 'psexec', 'cmdkey', 'winrs', 'pscp', 'winscp']);
DeviceEvents
| where Timestamp > ago(30d)
| where InitiatingProcessCommandLine has_any(MonitoredCommands) 
| where InitiatingProcessCommandLine matches regex '(?:(?:(?:-p)|(?:-password)|(?:-passwd)|(?:--password)|(?:--passwd)|(?:/P)|(?:/PASSWD)|(?:/PASSWORD))(?:\\s+|\\:)(?<password>(?:"((?:\\\\.|[^"\\\\])*)")|(?:[^\\s"]+)))'
or InitiatingProcessCommandLine matches regex '(?:(?:(?:-u)|(?:-user)|(?:-username)|(?:--user)|(?:--username)|(?:/u)|(?:/USER)|(?:/USERNAME))(?:\\s+|\\:)(?<username>(?:"((?:\\\\.|[^"\\\\])*)")|(?:[^\\s"]+)))'
| distinct DeviceName;

// MITRE ATT&CK technique mapping for your KQL code:

// Command and Scripting Interpreter (T1059): The query monitors commands like net, wmic, schtasks, psexec, cmdkey, winrs, pscp, and winscp, which are commonly used for scripting and command execution.
// Credential Dumping (T1003): The regex patterns in your query are designed to detect the use of passwords and usernames in command lines, which is indicative of credential dumping activities.
// Remote Services (T1021): Commands like psexec, winrs, pscp, and winscp are used for remote service execution and file transfer, aligning with lateral movement techniques.
// Scheduled Task/Job (T1053): The use of schtasks indicates the creation or modification of scheduled tasks, which is a common persistence technique.
// Windows Management Instrumentation (T1047): The wmic command is used for remote management and execution, which falls under this technique.