DeviceCredentialDeployment.exe

type: OSBinaries

Device Credential Deployment

Full path

C:\Windows\System32\DeviceCredentialDeployment.exe

Commands

ConcealUser T1564
Can be used to stealthily run a console application (e.g. cmd.exe) in the background
```
DeviceCredentialDeployment
```
Grab the console window handle and set it to hidden
os: Windows 10

Detection

IOCDeviceCredentialDeployment.exe should not be run on a normal workstation
Sigma https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_device_credential_deployment.yml

acknowledgement: Elliot Killick @elliotkillick