Event Log Readers: credentials in the security log

When an organization enables process-creation auditing (4688) with command lines, any command that takes a password as an argument (net use ... /user:..., cmdkey /pass:...) leaves that secret in cleartext in the Windows security log. Members of the Event Log Readers group, meant to let analysts or developers read logs without being administrators, can read that log and harvest the credentials. It is a case where a defensive measure (auditing commands) becomes a source of credentials for the attacker.

Mechanism

First confirm group membership (SID S-1-5-32-573):

net localgroup "Event Log Readers"
whoami /groups

With wevtutil we dump the security log as text and filter for lines that contain credentials:

wevtutil qe Security /rd:true /f:text | Select-String "/user"

Process Command Line:   net use Z: \\DB01\scripts /user:mary W1ntergreen_gum_2021!
Process Command Line:   cmdkey /add:WEB01 /user:amanda /pass:Passw0rd!

wevtutil also accepts alternate credentials and a remote host:

wevtutil qe Security /rd:true /f:text /r:<host> /u:<user> /p:<pass> | findstr "/user"

With PowerShell you can filter directly for 4688 events (the field with the command line is Properties[8]), although this path requires being an administrator or having adjusted the ACL on the HKLM\System\CurrentControlSet\Services\Eventlog\Security registry key, group membership alone is not enough:

Get-WinEvent -LogName security | ? { $_.ID -eq 4688 -and $_.Properties[8].Value -like '*/user*'} | select @{n='CommandLine';e={$_.Properties[8].Value}}

Requirements

Membership in Event Log Readers (or administrator), that the organization has 4688 auditing with command lines enabled, and that commands passing passwords as arguments exist (logon scripts, scheduled tasks, etc.). The Get-WinEvent path against the Security log additionally needs administrator rights or the adjusted ACL; wevtutil works with the group.

How to detect it

The abuse is given away by bulk reads of the Security log by non-administrator accounts (use of wevtutil qe Security by Event Log Readers members), Get-WinEvent queries filtering for 4688, and exfiltration of the log itself. Ironically, if process auditing is on, wevtutil itself generates its own 4688 event.

Defence. Never pass passwords on the command line (use interactive prompts or gMSA accounts); do not add users to Event Log Readers unless truly needed; forward logs to a SIEM and restrict local access; enable Protected Event Logging; and review scripts that embed credentials. Related to saved credentials on Windows, credential hunting, PowerShell history and autologon credentials.