Weak or Abused Passwords in CLI
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
Sigma
