Logged-On User Password Change Via Ksetup.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects attempts to change the password for the currently logged-on user using the 'ksetup.exe' utility. The detection specifically looks for the execution of 'ksetup.exe' with the '/ChangePassword' command-line argument. This activity could indicate an attacker attempting to modify user credentials on a compromised system.