Suspicious Computer Machine Password by PowerShell — Sigma Rule

Rule metadata and linked tags

Author: frack113. Source status: test; severity: medium. Source dates: 2022-02-21 / not supplied.

{
  "product": "windows",
  "category": "ps_module",
  "definition": "0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: deffb142bc3259ed55d03a5db27aa352be2a586796aae78c6bf8d66bb060886d

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Suspicious Computer Machine Password by PowerShell
id: e3818659-5016-4811-a73c-dde4679169d2
status: test
description: |
    The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain.
    You can use it to reset the password of the local computer.
references:
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1
    - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
author: frack113
date: 2022-02-21
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection:
        ContextInfo|contains: 'Reset-ComputerMachinePassword'
    condition: selection
falsepositives:
    - Administrator PowerShell scripts
level: medium

Original YAML and metadata in JSON

False positives

• Administrator PowerShell scripts

Source references

• https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1
• https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/