LOL · Binary

DeviceCredentialDeployment.exe

1 technique WindowsLOLBAS GPL-3.0

Conceal

Defense Evasion Windows

Grab the console window handle and set it to hidden

Use Can be used to stealthily run a console application (e.g. cmd.exe) in the background

DeviceCredentialDeployment

Context: user
Native: Conceal
MITRE: T1564
Detection: IOC: DeviceCredentialDeployment.exe should not be run on a normal workstation
Sigma: github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_device_credential_deployment.yml
Refs: lolbas-project.github.io/lolbas/Binaries/DeviceCredentialDeployment/