Device Credential Deployment Located at: C:\Windows\System32\DeviceCredentialDeployment.exe.
devicecredentialdeploymentdevicecredentialdeploymentSandbox: execFile · Timeout: 30s
security.defense-evasion.conceal Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Grab the console window handle and set it to hidden (Can be used to stealthily run a console application (e.g. cmd.exe) in the background)
DeviceCredentialDeployment| Type | Rule / Indicator |
|---|---|
| ioc | DeviceCredentialDeployment.exe should not be run on a normal workstation |
| sigma | https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_device_credential_deployment.yml |
devicecredentialdeployment is a Windows LOLBin. Device Credential Deployment Located at: C:\Windows\System32\DeviceCredentialDeployment.exe.