LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

DeviceCredentialDeployment.exe

View source

Device Credential Deployment

Conceal
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Conceal1

EXAMPLE 01T1564

Grab the console window handle and set it to hidden

COMMAND
DeviceCredentialDeployment
USE CASE
Can be used to stealthily run a console application (e.g. cmd.exe) in the background
PRIVILEGES
User
OPERATING SYSTEM
Windows 10
02 / ON DISK

Known paths

C:\Windows\System32\DeviceCredentialDeployment.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    DeviceCredentialDeployment.exe should not be run on a normal workstation

COMMUNITY RESEARCH

Acknowledgements

Elliot Killick@elliotkillick