Suspicious Computer Machine Password by PowerShell (e3818659-5016-4811-a73c-dde4679169d2)
The Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81) | Attack Pattern | Suspicious Computer Machine Password by PowerShell (e3818659-5016-4811-a73c-dde4679169d2) | Sigma-Rules | 1 |