Query: alert when Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script
Matching passage: Sigma rule: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script. Logsource: windows / process_creation. Rule: title: PUA - PingCastle Execution From Potentially Suspicious Parent id: b37998de-a70b-4f33-b219-ec36bf433dc0 related: - id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c type: derived status: test description: 'Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location. ' references: - https://github.com/vletoux/pingcastle - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450 - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680 - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699 - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8 - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1 author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2024-01-11 tags: - attack.reconnaissance - attack.t1595 logsource: category: process_creation product: windows detection: selection_parent_ext: ParentCommandLine|contains: - .bat - .chm - .cmd - .hta - .htm - .html - .js - .lnk - .ps1 - .vbe - .vbs - .wsf selection_parent_path_1: ParentCommandLine|contains: - :\Perflogs\ - :\Temp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp - \AppData\Roaming\ - \Temporary Internet selection_parent_path_2: - ParentCommandLine|contains|all: - :\Users\ - \Favorites\ - ParentCommandLine|contains|all: - :\Users\ - \Favourites\ - ParentCommandLine|contains|all: - :\Users\ - \Contacts\ selection_cli: - Image|endswith: \PingCastle.exe - OriginalFileName: PingCastle.exe - Product: Ping Castle - CommandLine|contains: - --scanner aclcheck - --scanner antivirus - --scanner computerversion - --scanner foreignusers - --scanner laps_bitlocker - --scanner localadmin - --scanner nullsession - --scanner nullsession-trust - --scanner oxidbindings - --scanner remote - --scanner share - --scanner smb - --scanner smb3querynetwork - --scanner spooler - --scanner startup - --scanner zerologon - CommandLine|contains: --no-enum-limit - CommandLine|contains|all: - --healthcheck - --level Full - CommandLine|contains|all:
Near-miss passage: Sigma rule: Detects usage of base64 utility to decode arbitrary base64-encoded text. Logsource: linux / process_creation. Rule: title: Decode Base64 Encoded Text id: e2072cab-8c9a-459b-b63c-40ae79e27031 status: test description: Detects usage of base64 utility to decode arbitrary base64-encoded text references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2021-11-27 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: linux detection: selection: Image|endswith: /base64 CommandLine|contains: -d condition: selection falsepositives: - Legitimate activities level: low