Detect Unsecured Credentials in Splunk
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files, operating system or application-specific repositories, shell history files, private key files, cloud instance metadata APIs, container environment variables, and group policy preference files. Tools like LaZagne, NirSoft utilities, and custom scripts are commonly used to automate credential harvesting across multiple storage locations simultaneously.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Canonical reference
- https://attack.mitre.org/techniques/T1552/
SPL Detection Query
| union
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(CommandLine="*password*" OR CommandLine="*passwd*" OR CommandLine="*credentials*" OR CommandLine="*secret*" OR CommandLine="*apikey*" OR CommandLine="*api_key*")
(CommandLine="*findstr*" OR CommandLine="*Get-Content*" OR CommandLine="*Select-String*" OR CommandLine="*grep*" OR CommandLine="* type *" OR CommandLine="*cat *")
| eval DetectionBranch="ScriptedCredentialSearch"
| eval RiskScore=25
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DetectionBranch, RiskScore
]
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*lazagne*" OR Image="*netpass*" OR Image="*passwordfox*" OR Image="*webbrowserpassview*" OR Image="*vaultpassview*" OR Image="*credentialfileview*" OR Image="*mailpassview*")
OR (CommandLine="*lazagne*" OR CommandLine="*netpass*" OR CommandLine="*nirsoft*")
| eval DetectionBranch="CredentialHarvestingTool"
| eval RiskScore=75
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DetectionBranch, RiskScore
]
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
(TargetObject="*\\WinVNC3\\Password*" OR TargetObject="*\\TightVNC\\Server*" OR TargetObject="*\\RealVNC*" OR TargetObject="*Winlogon*DefaultPassword*" OR TargetObject="*PuTTY\\Sessions*" OR TargetObject="*SNMP*ValidCommunities*")
| eval DetectionBranch="RegistryCredentialAccess"
| eval RiskScore=50
| table _time, host, User, Image, CommandLine, TargetObject, Details, ParentImage, DetectionBranch, RiskScore
]
[
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*.pem" OR TargetFilename="*.pfx" OR TargetFilename="*.p12" OR TargetFilename="*id_rsa*" OR TargetFilename="*id_dsa*" OR TargetFilename="*id_ecdsa*" OR TargetFilename="*unattend.xml" OR TargetFilename="*credentials" OR TargetFilename="*vnc.ini" OR TargetFilename="*winscp.ini")
NOT (Image="*\\svchost.exe" OR Image="*\\SearchIndexer.exe" OR Image="*\\MsMpEng.exe")
| eval DetectionBranch="CredentialFileCreatedOrAccessed"
| eval RiskScore=40
| table _time, host, User, Image, TargetFilename, CommandLine, ParentImage, DetectionBranch, RiskScore
]
| eval Severity=case(RiskScore >= 75, "Critical", RiskScore >= 50, "High", RiskScore >= 25, "Medium", true(), "Low")
| sort - RiskScore, - _timeMulti-branch Splunk detection for T1552 Unsecured Credentials using Sysmon operational logs. Uses a union across four detection branches: (1) Sysmon Event ID 1 process creation catching scripted credential searches with findstr, Get-Content, grep, or Select-String combined with credential keywords; (2) Event ID 1 for known NirSoft credential harvesting tool execution including LaZagne, NetPass, PasswordFox, WebBrowserPassView; (3) Sysmon Event ID 13 (Registry Value Set) monitoring credential storage registry paths such as VNC password locations, PuTTY sessions, and Winlogon auto-login passwords; (4) Sysmon Event ID 11 (File Create) detecting access to private key files (.pem, .pfx, .p12), SSH key files (id_rsa, id_dsa), and unattend.xml files. Risk scoring prioritizes known tool execution (75) over registry queries (50), suspicious file activity (40), and scripted searches (25).
Data Sources
Required Sourcetypes
False Positives & Tuning
- Password managers reading their own encrypted credential stores during normal operation
- SSH tooling (PuTTY, OpenSSH for Windows, WinSCP) accessing .pem and known_hosts files during connection establishment
- Backup and archival software accessing all file types including private keys and configuration files
- DevOps pipeline agents reading web.config, unattend.xml, or credential files during CI/CD deployments
- IT provisioning scripts using findstr or Select-String to validate configuration file contents post-deployment
Other platforms for T1552
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 LaZagne All-Sources Credential Harvest Simulation
Expected signal: Sysmon Event ID 1: Process Create for lazagne.exe with CommandLine 'all -oN'. Sysmon Event ID 11: Multiple file access events across browser profile directories, %APPDATA% credential stores, and credential files. Sysmon Event ID 13: Registry queries to PuTTY, VNC, and Winlogon password locations. File creation event for lazagne_test_output.txt.
- Test 2 Scripted Credential File Search via PowerShell Select-String
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing both 'Select-String' and 'password'. PowerShell ScriptBlock Log Event ID 4104 capturing the full pipeline. Sysmon Event ID 11 for cred_search_results.txt creation. Multiple file access events as Select-String reads candidate files.
- Test 3 Registry Credential Extraction — PuTTY and Winlogon
Expected signal: Sysmon Event ID 1: Process Create for reg.exe with CommandLine querying PuTTY sessions path. If Sysmon is configured to monitor registry access, Event ID 13 showing TargetObject paths. Security Event ID 4663 (if object access auditing enabled) for registry key read operations.
- Test 4 Private Key Enumeration and Staging
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine referencing '.pem', '.pfx', 'id_rsa'. Sysmon Event ID 11: File creation for key_staging directory. Multiple file access events as Get-ChildItem reads candidate key files. PowerShell ScriptBlock Log Event ID 4104 with full enumeration script.
- Test 5 NirSoft WebBrowserPassView Credential Extraction
Expected signal: Sysmon Event ID 1: Process Create for WebBrowserPassView.exe. Sysmon Event ID 11: File access to Chrome Login Data SQLite file at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data, Firefox logins.json, Edge Login Data. File creation event for browser_creds_test.html output. If DPAPI decryption is used, potential Event ID 4693 (DPAPI decryption) in Security log.
References (5)
- https://attack.mitre.org/techniques/T1552/
- https://github.com/AlessandroZ/LaZagne
- https://www.nirsoft.net/password_recovery_tools.html
- https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552/T1552.md
Response Playbook
Triage
- Identify which detection branch fired — tool-based detections (LaZagne, NirSoft) require immediate escalation; file access patterns require further context before escalation
- Examine the initiating process and its parent process chain — was a browser, Office application, or script interpreter spawning credential search activity? This strongly suggests post-exploitation
- Review the user account context — is this a service account, administrator, or standard user? Standard users accessing /etc/shadow or SYSTEM-level credential stores is a critical indicator
- Check the scope of credential file access — was a single file accessed (low risk) or did the process enumerate multiple credential locations across multiple directories in a short time window (high risk)?
- Query DeviceProcessEvents for the same host and user in the ±30 minutes around the alert timestamp — look for prior suspicious activity (phishing delivery, script execution, LOLBin use) that may indicate the credential search is a later stage of compromise
- For scripted searches (findstr/grep/Select-String), decode or reconstruct the full command to determine exact search terms — legitimate admins rarely search for 'password' or 'secret' across the filesystem without an explicit ticket
- Check for network activity from the same process after credential access — lateral movement or exfiltration attempts following credential harvesting are the key risk to contain
- For registry-based detections, identify which application the registry key belongs to and whether the accessing process is the expected owner or an unrelated process
Containment
- If known credential harvesting tool (LaZagne, Mimikatz, NirSoft) detected: immediately isolate the endpoint from the network via EDR network isolation or VLAN quarantine to prevent lateral movement with harvested credentials
- If credentials were likely accessed, assume all credentials stored on or accessible from that endpoint are compromised — initiate emergency rotation for service accounts, local admin accounts, and any credentials found in identified files
- If SSH private keys were accessed: revoke public keys from authorized_keys files on all remote systems accessible from the compromised endpoint and generate new key pairs
- If cloud credentials (AWS ~/.aws/credentials, Azure service principal files, GCP service account JSON) were accessed: immediately revoke and rotate the associated access keys and service principal secrets via the cloud provider console
- Block the user account in Active Directory and revoke active Kerberos tickets (run: klist purge on the endpoint; force replication of account lock) to prevent use of any cached domain credentials
- Preserve the endpoint for forensic analysis before reimaging — acquire memory dump and relevant log files
Evidence Collection
- File System: Enumerate all files accessed by the suspicious process using Sysmon Event ID 10 (Process Access) and Event ID 11 (File Create) correlated with the process PID
- File System: Check for exfiltration staging — look for compressed archives (.zip, .7z, .rar) created in Temp, AppData, or Downloads around the same time as credential access
- Registry: Export the registry hives accessed (HKCU\Software\SimonTatham\PuTTY\Sessions, HKLM\SOFTWARE\RealVNC, etc.) to document what credentials were stored there
- Process: Collect the full process tree via Sysmon Event ID 1 starting from the parent of the suspicious process — document PID, PPID, command lines, and hashes for all processes
- Network: Query Sysmon Event ID 3 (Network Connection) for outbound connections made by the suspicious process and any child processes — document destination IPs, ports, and connection counts
- Memory: Capture a full memory dump of the suspicious process if still running using ProcDump: procdump.exe -ma <PID> C:\evidence\<PID>.dmp
- Shell History: Preserve PowerShell ScriptBlock logs (Event IDs 4103/4104) from Microsoft-Windows-PowerShell/Operational channel and PSReadLine history file at $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
- Browser Credentials: Document which browser credential stores exist on the system (Chrome Login Data, Firefox logins.json, Edge Login Data) and whether they were accessed
- Prefetch: Capture and analyze prefetch files for the harvesting tool (C:\Windows\Prefetch\LAZAGNE.EXE-*.pf etc.) to establish execution timeline and loaded libraries
Escalation Criteria
- !Known credential harvesting tool (LaZagne, Mimikatz, NirSoft suite, fgdump, pwdump) detected executing on any endpoint regardless of whether it appears successful
- !Cloud credential files accessed (.aws/credentials, service account JSON, Azure CLI token cache) — cloud credentials enable lateral movement across the entire cloud environment, not just the local network
- !Private key files (.pem, .pfx, .p12, id_rsa) accessed by a process other than the owning application — compromised PKI material can enable impersonation and certificate fraud
- !Credential harvesting activity detected on a server or privileged workstation (domain controller, PAM station, build server, secrets management host)
- !Evidence of credential access followed within 30 minutes by new remote connection attempts (Sysmon Event ID 3, Security Event ID 4624 Type 3/10) — indicates active lateral movement using harvested credentials
- !Multiple credential storage locations enumerated sequentially by the same process — automated tooling pattern consistent with LaZagne's all-sources scan mode
- !Unattend.xml or Sysprep.inf accessed — these imaging configuration files frequently contain domain join and local administrator credentials in cleartext
Investigation Guide
Related Techniques
Forensic Artifacts
- >
File System: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — PowerShell command history including any commands containing credential keywords - >
File System: ~/.bash_history, ~/.zsh_history, ~/.fish_history — Linux/macOS shell history files potentially containing credentials passed as arguments - >
File System: ~/.aws/credentials and ~/.aws/config — AWS CLI stored access keys and session tokens - >
File System: %APPDATA%\Microsoft\Credentials\ and %LOCALAPPDATA%\Microsoft\Credentials\ — DPAPI-protected Windows Credential Manager blobs - >
File System: %APPDATA%\Microsoft\Protect\ — DPAPI master keys used to decrypt Windows credential blobs - >
Registry: HKCU\Software\SimonTatham\PuTTY\Sessions — stored SSH session configurations potentially including passwords - >
Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon — DefaultPassword value if auto-logon is configured - >
Registry: HKLM\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities — SNMP community strings - >
Browser Credential Stores: Chrome/Edge %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data (SQLite), Firefox %APPDATA%\Mozilla\Firefox\Profiles\*.default\logins.json - >
Event Log: Microsoft-Windows-PowerShell/Operational Event ID 4104 — ScriptBlock logs capturing credential search scripts - >
Windows Vault: cmdkey /list output, vaultcmd /listcreds:"Windows Credentials" — enumeration of Windows Credential Manager entries - >
Prefetch: C:\Windows\Prefetch\LAZAGNE.EXE-*.pf, NETPASS.EXE-*.pf — execution evidence for credential harvesting tools
Tuning Guidance
Begin tuning by baselining which processes legitimately access credential-adjacent files and registry keys in your environment. Key exclusion candidates include: (1) SSH clients (ssh.exe, plink.exe, winscp.exe) accessing .pem and known_hosts files — add process + file type allowlist entries; (2) Password managers (KeePass, Bitwarden, 1Password) reading their own .kdbx or credential store files — exclude by process hash rather than process name to prevent tool masquerading; (3) Configuration management agents (SCCM, Ansible, Puppet) accessing web.config or unattend.xml during deployments — exclude by source IP or parent process. Elevate alert priority when multiple branches fire for the same host within 15 minutes, as this indicates a tool performing multi-source credential harvesting rather than incidental access. For scripted search detection, add environment-specific allowlist terms: if your infrastructure team legitimately runs scripts that search for 'connection_string' in config files, scope exclusions to specific service accounts and script paths rather than suppressing the entire pattern. Consider adding cloud credential file paths (.aws/credentials, gcp service account JSON locations, Azure CLI token cache) to the file access detection — these are high-value targets that warrant critical severity alerts regardless of context.
Hunting Queries
Hunt for accounts repeatedly using scripted filesystem searches targeting credential keyword patterns. Legitimate administrators rarely need to grep across the filesystem for passwords — multiple occurrences from the same user account or initiated from the same parent process (especially script interpreters) indicates automated credential harvesting.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @"(?i)(findstr|select-string|grep|sls\s).{0,100}(passw|passwd|creds|secret|apikey|token|connectionstring)"
| summarize Count=count(), UniqueDevices=dcount(DeviceName),
Commands=make_set(ProcessCommandLine, 5),
Earliest=min(Timestamp), Latest=max(Timestamp)
by AccountName, InitiatingProcessFileName
| where Count > 2
| sort by Count descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
(CommandLine="*findstr*" OR CommandLine="*Select-String*" OR CommandLine="*grep*")
(CommandLine="*passw*" OR CommandLine="*passwd*" OR CommandLine="*creds*" OR CommandLine="*secret*" OR CommandLine="*apikey*" OR CommandLine="*token*" OR CommandLine="*connectionstring*")
| stats count as SearchCount, dc(host) as UniqueHosts, values(CommandLine) as SampleCommands, earliest(_time) as Earliest, latest(_time) as Latest by User, ParentImage
| where SearchCount > 2
| sort - SearchCountHunt for bulk access to private key and credential store files within 15-minute windows, excluding known legitimate owners. Adversary credential harvesting tools typically access many credential file types in rapid succession — three or more distinct credential files accessed by an unexpected process within 15 minutes is a high-fidelity indicator of automated harvesting.
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName endswith ".pem" or FileName endswith ".pfx" or FileName endswith ".p12"
or FileName endswith "id_rsa" or FileName endswith "id_dsa" or FileName endswith "id_ecdsa" or FileName endswith "id_ed25519"
or FileName =~ "credentials" or FileName endswith ".kdbx" or FileName =~ "logins.json"
| where ActionType in ("FileAccessed", "FileCopied", "FileRead")
| where InitiatingProcessFileName !in~ ("ssh.exe", "ssh-keygen.exe", "plink.exe", "scp.exe", "sftp.exe", "winscp.exe", "keepass.exe", "keepassxc.exe")
| summarize AccessCount=count(), AccessedFiles=make_set(FolderPath, 10), Processes=make_set(InitiatingProcessFileName, 5)
by DeviceName, AccountName, bin(Timestamp, 15m)
| where AccessCount > 3
| sort by AccessCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*.pem" OR TargetFilename="*.pfx" OR TargetFilename="*.p12" OR TargetFilename="*id_rsa" OR TargetFilename="*id_dsa" OR TargetFilename="*id_ecdsa" OR TargetFilename="*logins.json" OR TargetFilename="*.kdbx" OR TargetFilename="*credentials")
NOT (Image="*\\ssh.exe" OR Image="*\\ssh-keygen.exe" OR Image="*\\plink.exe" OR Image="*\\winscp.exe" OR Image="*\\keepass.exe")
| bin _time span=15m
| stats count as AccessCount, values(TargetFilename) as AccessedFiles, values(Image) as Processes by host, User, _time
| where AccessCount > 3
| sort - AccessCountHunt for processes querying multiple credential-related registry paths within a 30-minute window. Legitimate applications only access their own registry locations — a process querying VNC, PuTTY, SNMP, and Winlogon password locations in the same session is a strong indicator of automated registry credential harvesting, as performed by tools like LaZagne's registry module.
DeviceRegistryEvents
| where Timestamp > ago(7d)
| where RegistryKey has_any (
"PuTTY\\Sessions", "WinVNC3", "TightVNC", "RealVNC",
"Winlogon", "SNMP\\Parameters", "OpenSSH"
)
| where RegistryValueName has_any ("Password", "DefaultPassword", "ProxyPassword", "PublicKeyFile", "PrivateKeyFile")
| where ActionType in ("RegistryKeyQueried", "RegistryValueQueried")
| where InitiatingProcessFileName !in~ ("lsass.exe", "services.exe", "svchost.exe")
| summarize QueryCount=count(), RegistryKeys=make_set(RegistryKey, 10),
Processes=make_set(InitiatingProcessFileName, 5)
by DeviceName, AccountName, bin(Timestamp, 30m)
| where QueryCount > 2 or array_length(RegistryKeys) > 2
| sort by QueryCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
(TargetObject="*PuTTY\\Sessions*" OR TargetObject="*WinVNC3*" OR TargetObject="*TightVNC*" OR TargetObject="*RealVNC*" OR TargetObject="*Winlogon*" OR TargetObject="*SNMP\\Parameters*")
(TargetObject="*Password*" OR TargetObject="*DefaultPassword*" OR TargetObject="*ProxyPassword*")
NOT (Image="*\\lsass.exe" OR Image="*\\svchost.exe" OR Image="*\\services.exe")
| bin _time span=30m
| stats count as QueryCount, values(TargetObject) as RegistryKeys, values(Image) as Processes by host, User, _time
| where QueryCount > 2
| sort - QueryCountAtomic Red Team Tests
Simulates execution of LaZagne, an open-source credential recovery tool that searches 60+ application credential stores including browsers, email clients, databases, SVN, Git, WiFi, and Windows credential manager. Uses the 'all' module to trigger broad file and registry access patterns detectable by this rule. Download from GitHub Releases before running in your test environment only.
Command
lazagne.exe all -oN -output C:\temp\lazagne_test_output.txtCleanup
Remove-Item C:\temp\lazagne_test_output.txt -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create for lazagne.exe with CommandLine 'all -oN'. Sysmon Event ID 11: Multiple file access events across browser profile directories, %APPDATA% credential stores, and credential files. Sysmon Event ID 13: Registry queries to PuTTY, VNC, and Winlogon password locations. File creation event for lazagne_test_output.txt.
Expected Detection
KQL Branch 2 (CredentialHarvestingTool) fires immediately on 'lazagne' in Image name. SPL branch 2 fires on Image containing 'lazagne'. Multiple Sysmon Event ID 11 events from branches 1/4 as tool accesses files. Risk score 75 (Critical severity).
Uses PowerShell Select-String (equivalent to grep) to search for credential patterns across common Windows directories. Simulates adversary behavior of searching for plaintext passwords embedded in script files, configuration files, and deployment artifacts left on disk.
Command
Get-ChildItem -Path C:\Users,$env:PROGRAMDATA,C:\inetpub -Recurse -Include *.txt,*.xml,*.config,*.ini,*.ps1,*.bat -ErrorAction SilentlyContinue | Select-String -Pattern "password|passwd|credentials|api_key|secret" -CaseSensitive:$false | Select-Object -First 20 | Out-File $env:TEMP\cred_search_results.txtCleanup
Remove-Item $env:TEMP\cred_search_results.txt -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing both 'Select-String' and 'password'. PowerShell ScriptBlock Log Event ID 4104 capturing the full pipeline. Sysmon Event ID 11 for cred_search_results.txt creation. Multiple file access events as Select-String reads candidate files.
Expected Detection
KQL Branch 4 (ScriptedCredentialSearch) fires on 'Select-String' + 'password' combination. SPL Branch 1 fires on EventCode=1 with matching CommandLine patterns. Alert classified as Medium severity (RiskScore 25) — correlate with file creation event to elevate.
Queries Windows Registry locations where applications commonly store credentials insecurely. Targets PuTTY saved sessions (which may contain SSH passwords) and the Winlogon DefaultPassword key (used for auto-login configurations). Both are targeted by LaZagne's Windows registry module and manual attacker enumeration.
Command
reg query HKCU\Software\SimonTatham\PuTTY\Sessions /s 2>&1; reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword 2>&1; reg query "HKLM\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ValidCommunities" 2>&1Expected Telemetry
Sysmon Event ID 1: Process Create for reg.exe with CommandLine querying PuTTY sessions path. If Sysmon is configured to monitor registry access, Event ID 13 showing TargetObject paths. Security Event ID 4663 (if object access auditing enabled) for registry key read operations.
Expected Detection
KQL Branch 3 (RegistryCredentialQuery) fires on RegistryKey containing 'PuTTY\Sessions' and 'Winlogon'. SPL Branch 3 fires on EventCode=13 with TargetObject patterns. Alert classified as High severity (RiskScore 50).
Searches for private key files across the filesystem and copies found keys to a staging directory — simulating the exfiltration preparation step that follows private key discovery. Private keys (.pem, .pfx, id_rsa) grant authentication to remote systems without passwords and are high-value targets in credential theft operations.
Command
New-Item -ItemType Directory -Path $env:TEMP\key_staging -Force; Get-ChildItem -Path C:\Users -Recurse -Include *.pem,*.pfx,*.p12,id_rsa,id_dsa,id_ecdsa,id_ed25519 -ErrorAction SilentlyContinue | Select-Object -First 5 | ForEach-Object { Write-Host "Found: $($_.FullName)" }Cleanup
Remove-Item $env:TEMP\key_staging -Recurse -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create for powershell.exe with CommandLine referencing '.pem', '.pfx', 'id_rsa'. Sysmon Event ID 11: File creation for key_staging directory. Multiple file access events as Get-ChildItem reads candidate key files. PowerShell ScriptBlock Log Event ID 4104 with full enumeration script.
Expected Detection
KQL Branch 1 (CredentialFileAccess) fires as .pem/.pfx/id_rsa patterns match FileName filter. SPL Branch 4 fires on Sysmon EventCode=11 matching private key file extensions. Additionally, KQL Branch 4 fires on the PowerShell commandline containing 'id_rsa' and file access patterns.
Simulates execution of WebBrowserPassView (NirSoft), a legitimate password recovery utility commonly abused by malware including Astaroth and DarkGate. This tool reads browser credential stores for Chrome, Edge, Firefox, IE, and Opera and presents them in cleartext. Run in isolated test environment only — tool requires download from NirSoft.
Command
WebBrowserPassView.exe /shtml C:\temp\browser_creds_test.htmlCleanup
Remove-Item C:\temp\browser_creds_test.html -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create for WebBrowserPassView.exe. Sysmon Event ID 11: File access to Chrome Login Data SQLite file at %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data, Firefox logins.json, Edge Login Data. File creation event for browser_creds_test.html output. If DPAPI decryption is used, potential Event ID 4693 (DPAPI decryption) in Security log.
Expected Detection
KQL Branch 2 (CredentialHarvestingTool) fires immediately on 'webbrowserpassview' in FileName. SPL Branch 2 fires on Image containing 'webbrowserpassview'. Risk score 75 triggers Critical severity alert. File access to Chrome Login Data also triggers Branch 1 (CredentialFileAccess).