Suspicious Key Manager Access via Rundll32

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

This rule detects the execution of 'rundll32.exe' with specific command-line arguments ('keymgr' and 'KRShowKeyMgr') which indicates an attempt to invoke the Stored User Names and Passwords dialogue, also known as the Key Manager. This activity can be used by adversaries to access or backup stored credentials.