`extract-credentials` command

[YamatoSecurity]

I'd like to create a command that tries to identify commands that were entered that contain usernames or passwords. Similar to what is explained here: https://practicalsecurityanalytics.com/extracting-credentials-from-windows-logs/ There is a risk that administrators will enter plaintext username and passwords into the command line which gets logged in 4688 events and sysmon 1 events. Attackers may abuse this for offensive purposes as described in the article, so it is important for blue teams as well to understand if these plaintext passwords are being leaked in command line option logging. (If the blue team finds credentials being logged, they can inform the user to change their password/API key and warn them of the risks)

We should also include a regular expression check to look for API keys being leaked in the event logs as well.

Output to the terminal can be a table with the following information: Timestamp, Computer, Event (Sec-4688 or Sysmon 1), Username, Password, API Key, Commandline or output to a CSV file.

@fukusuket Could I ask you to do this one?

[fukusuket]

Sounds good!! Yes! I would love to implement it!💪

[YamatoSecurity]

@fukusuket Thanks!

[fukusuket]

Memo

Reference

• https://learn.microsoft.com/ja-jp/windows/win32/wmisdk/wmic
• https://learn.microsoft.com/ja-jp/windows-server/administration/windows-commands/schtasks-create#parameters
• https://learn.microsoft.com/ja-jp/windows-server/administration/windows-commands/schtasks-query#parameters
• https://learn.microsoft.com/ja-jp/windows-server/administration/windows-commands/schtasks-run#parameters
• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/gg651155(v=ws.11)#parameters
• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771865(v=ws.11)#parameters
• https://learn.microsoft.com/ja-jp/sysinternals/downloads/psexec#using-psexec

Sample Command

wmic /node:dc /user:vagrant /password:vagrant process get name
schtasks /Create /S dc /U vagrant /P vagrant /SC DAILY /TN MyTask /TR C:/Path/To/MyScript.vbs /ST 14:00
net user testuser Password!#@$ /add
psexec \\dc -u dc\vagrant -p vagrant systeminfo