MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1552Unsecured Credentials

Credential Access

View on MITRE ATT&CK →

1 Query

Cleartext Password Detected in Process Command Line

mediumtestingDefender XDR

Microsoft Defender for Endpoint·DeviceProcessEvents

DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("-password", "/password", "-p ", "--password")
| where ProcessCommandLine has_any ("net use", "net user", "runas", "cmdkey", "psexec", "schtasks")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc

Bert-JanP (adapted) · last tested 2025-03-01

attack.mitre.org
github.com

Tuning notes

Automation scripts and deployment tools may pass credentials via CLI. Build an exclusion list based on known service accounts and deployment tooling.

+ Add another query for this technique →