Applications with plaintext passwords

Table of applications identified as potentially handling plaintext passwords.

CQL · Falcon Next-Gen SIEMCopy query

"#event_simpleName" = ProcessRollup2 event_platform="Win" CommandLine=/REDACTED/
| wildcard(field=ComputerName, pattern=?ComputerName, ignoreCase=true)
| groupBy([FileName], function=[count(aid, distinct=true, as="Hosts")])
| sort(Hosts)

Falcon automatically attempts to redact plain-text passwords in process command lines to prevent sensitive data exposure. When this occurs, the password string is replaced with the marker /REDACTED/. Therefore, during analysis we specifically look for the /REDACTED/ placeholder within command-line arguments as an indicator that Falcon has detected and masked a potential plain-text password.

Reference: https://www.reddit.com/r/crowdstrike/comments/u8ji4i/commandline_redacted/

applications_with_plaintext_passwords.yml

T1552

ByteRay GmbH

Hunting

Endpoint

Insight

2025-08-26

Applications with plaintext passwords

Get this query running in your SIEM, with someone on call.