Query: alert when Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExe
Matching passage: Sigma rule: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExe. Logsource: windows / process_creation. Rule: title: HackTool - Impersonate Execution id: cf0c254b-22f1-4b2b-8221-e137b3c0af94 status: test description: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively references: - https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ - https://github.com/sensepost/impersonate author: Sai Prashanth Pulisetti @pulisettis date: 2022-12-21 modified: 2024-11-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.003 logsource: product: windows category: process_creation detection: selection_commandline_exe: CommandLine|contains: impersonate.exe selection_commandline_opt: CommandLine|contains: - ' list ' - ' exec ' - ' adduser ' selection_hash: Hashes|contains: - MD5=9520714AB576B0ED01D1513691377D01 - SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A - IMPHASH=0A358FFC1697B7A07D0E817AC740DF62 condition: all of selection_commandline_* or selection_hash falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json. The db.sqlite file in Signal Desktop. Logsource: windows / security. Rule: title: File Access Of Signal Desktop Sensitive Data id: 5d6c375a-18ae-4952-b4f6-8b803f6c8555 status: experimental description: 'Detects access to Signal Desktop''s sensitive data files: db.sqlite and config.json. The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data. Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials. Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed. ' references: - https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/ - https://vmois.dev/query-signal-desktop-messages-sqlite/ author: Andreas Braathen (mnemonic.io) date: 2025-10-19 tags: - attack.credential-access - attack.t1003 logsource: product: windows service: security definition: 'Requirements: System Access Control List (SACL) policy with attributes List folder/read data on Objects' detection: selection: EventID: 4663 ObjectType: File ObjectName|contains: \AppData\Roaming\Signal\ ObjectName|endswith: - \config.json - \db.sqlite filter_main_signal: ProcessName|endswith: - \signal-portable.exe - \signal.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely, but possible from AV or backup software accessing the files. level: medium