{"id":"2d3cdeec-c0db-45b4-aa86-082f7eb75701","title":"Microsoft IIS Service Account Password Dumped","description":"Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords","author":"Tim Rauch, Janantha Marasinghe, Elastic (original idea)","status":"test","level":"high","date":"2022-11-08","modified":"2023-01-22","tags":["attack.credential-access","attack.t1003"],"technique_ids":["T1003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.elastic.co/guide/en/security/current/microsoft-iis-service-account-password-dumped.html","https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA","https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-2/"],"source_path":"rules/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml","source_sha256":"5abefddd79de2632166d22181b560b6038181696604d8ff84a7d3c78b8a9fe01","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Microsoft IIS Service Account Password Dumped\nid: 2d3cdeec-c0db-45b4-aa86-082f7eb75701\nstatus: test\ndescription: Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords\nreferences:\n    - https://www.elastic.co/guide/en/security/current/microsoft-iis-service-account-password-dumped.html\n    - https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA\n    - https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-2/\nauthor: Tim Rauch, Janantha Marasinghe, Elastic (original idea)\ndate: 2022-11-08\nmodified: 2023-01-22\ntags:\n    - attack.credential-access\n    - attack.t1003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_base_name:\n        - Image|endswith: '\\appcmd.exe'\n        - OriginalFileName: 'appcmd.exe'\n    selection_base_list:\n        CommandLine|contains: 'list '\n    selection_standalone:\n        CommandLine|contains:\n            - ' /config' # https://pbs.twimg.com/media/FgydDAJWIAEio34?format=png&name=900x900\n            - ' /xml'\n            # We cover the \"-\" version just in case :)\n            - ' -config'\n            - ' -xml'\n    selection_cmd_flags:\n        CommandLine|contains:\n            - ' /@t' # Covers both \"/@text:*\" and \"/@t:*\"\n            - ' /text'\n            - ' /show'\n            # We cover the \"-\" version just in case :)\n            - ' -@t'\n            - ' -text'\n            - ' -show'\n    selection_cmd_grep:\n        CommandLine|contains:\n            - ':\\*'\n            - 'password'\n    condition: all of selection_base_* and (selection_standalone or all of selection_cmd_*)\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","page":"techniques/enterprise/T1003/"}],"data_path":"data/detection-rules/2d3cdeec-c0db-45b4-aa86-082f7eb75701.json","kind":"sigma"}