Query: detect Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely in logs
Matching passage: Sigma rule: Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely. Logsource: windows / process_creation. Rule: title: HackTool - SharpImpersonation Execution id: f89b08d0-77ad-4728-817b-9b16c5a69c7a related: - id: cf0c254b-22f1-4b2b-8221-e137b3c0af94 type: similar status: test description: Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively references: - https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/ - https://github.com/S3cur3Th1sSh1t/SharpImpersonation author: Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems) date: 2022-12-27 modified: 2023-02-13 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.003 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \SharpImpersonation.exe - OriginalFileName: SharpImpersonation.exe selection_cli: - CommandLine|contains|all: - ' user:' - ' binary:' - CommandLine|contains|all: - ' user:' - ' shellcode:' - CommandLine|contains: - ' technique:CreateProcessAsUserW' - ' technique:ImpersonateLoggedOnuser' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious shell commands used in various Equation Group scripts and tools. Logsource: linux. Rule: title: Equation Group Indicators id: 41e5c73d-9983-4b69-bd03-e13b67e9623c status: test description: Detects suspicious shell commands used in various Equation Group scripts and tools references: - https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1 author: Florian Roth (Nextron Systems) date: 2017-04-09 modified: 2021-11-27 tags: - attack.execution - attack.g0020 - attack.t1059.004 logsource: product: linux detection: keywords: - 'chown root*chmod 4777 ' - cp /bin/sh .;chown - chmod 4777 /tmp/.scsi/dev/bin/gsh - chown root:root /tmp/.scsi/dev/bin/ - chown root:root x; - /bin/telnet locip locport < /dev/console | /bin/sh - /tmp/ratload - 'ewok -t ' - 'xspy -display ' - cat > /dev/tcp/127.0.0.1/80 <<END - rm -f /current/tmp/ftshell.latest - 'ghost_* -v ' - ' --wipe > /dev/null' - ping -c 2 *; grep * /proc/net/arp >/tmp/gx - iptables * OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP; - '> /var/log/audit/audit.log; rm -f .' - cp /var/log/audit/audit.log .tmp - sh >/dev/tcp/* <&1 2>&1 - ncat -vv -l -p * < - nc -vv -l -p * < - < /dev/console | uudecode && uncompress - sendmail -osendmail;chmod +x sendmail - /usr/bin/wget -O /tmp/a http* && chmod 755 /tmp/cron - chmod 666 /var/run/utmp~ - chmod 700 nscd crond - cp /etc/shadow /tmp/. - </dev/console |uudecode > /dev/null 2>&1 && uncompress - chmod 700 jp&&netstat -an|grep - uudecode > /dev/null 2>&1 && uncompress -f * && chmod 755 - chmod 700 crond - wget http*; chmod +x /tmp/sendmail - chmod 700 fp sendmail pt - chmod 755 /usr/vmsys/bin/pipe - chmod -R 755 /usr/vmsys - chmod 755 $opbin/*tunnel - chmod 700 sendmail - chmod 0700 sendmail - /usr/bin/wget http*sendmail;chmod +x sendmail; - '&& telnet * 2>&1 </dev/console' condition: keywords falsepositives: - Unknown level: high