Identifier / Programs / Windows
devicecredentialdeployment.exe
"DeviceCredentialDeployment.exe" file version info (xCyclopedia)
LOLBAS Conceal 1 Sigma rule name it 2 ATT&CK techniques 1 documented command 5 known copies with hashes
How devicecredentialdeployment.exe is abused
Conceal T1564 Hide Artifacts
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for devicecredentialdeployment.exe.
1 documented command
Conceal T1564 Hide Artifacts User privileges
Grab the console window handle and set it to hidden
DeviceCredentialDeploymentTrips 1 Sigma rule: mediumDeviceCredentialDeployment Execution by Nasreddine Bencherchali (Nextron Systems)
The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for devicecredentialdeployment.exe, by Elliot Killick, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for devicecredentialdeployment.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real devicecredentialdeployment.exe?
"DeviceCredentialDeployment.exe" in the file’s header: a renamed copy still carries itC:\Windows\system32\5 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\DeviceCredentialDeployment.exe · signed by Microsoft Windows
78745d14d3a3db287285476b49f0e4b21d4d1f85ff2d0d2639de1c6928b1caef10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\DeviceCredentialDeployment.exe · signed by Microsoft Windows
84d481ae5efee8a53705c35fda95ee49d5f4d3abb8d7edea139ebe6eb82849c610.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DeviceCredentialDeployment.exe · signed by Microsoft Windows
774b570c43254d32b769489270e6ade3f39cceb19985675339aee06afaf230cd10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\DeviceCredentialDeployment.exe · signed by Microsoft Windows
e1fd74c2ad2bb2d81a3b664cb8dfaa530490a1ebcf63b0e4607c9cc49f4839a010.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\DeviceCredentialDeployment.exe · signed by Microsoft Windows
3274d12cdb16a7f44a96335ae17151c6c8667fbfe36e4c11edc9d1b825078e17From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.