Catch clear text password in NETLOGON files

Products PingCastle Ideas
,
1

What is a one sentence summary of your feature request?

Catch clear text password in NETLOGON files

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

Report files in the NETLOGON folders with clear text password, i.e. :

  • look for “/password:” string in *.bat file
  • look for “;password=” string in *.reg file
  • etc

How do you currently solve the challenges you have by not having this feature?

Run adhoc PS script manually to identify

2 Likes
2

We will get a rule in for this.

I think keeping it simple and looking for common options makes sense.

I think your two plus:

  • password or passwd across any txt based file type is worth checking in netlogon. (Bat/txt/reg/vbs/rtf etc).
  • Some regex for ConvertTo-SecureString and System.Management.Automation.PSCredential in the same script or something for PowerShell. Also just a $Password variable for generic but would be caught above.

Definitely open to hearing any other specific things to look for or whether the generic rules would work.