Fake Windows Security credential prompt (TukTuk Cred Prompt)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•5

Detects the execution of processes or creation of events attempting to mimic Windows Security credential prompts. This pattern is characteristic of the TukTuk C2 framework's 'Cred Prompt' feature, designed to harvest user credentials by presenting a fake authentication dialog.