Query: detection rule: This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been re
Matching passage: Sigma rule: This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been re. Logsource: windows / process_creation. Rule: title: HackTool - CrackMapExec Execution id: 42a993dd-bb3e-48c8-b372-4d6684c4106c status: test description: This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced. references: - https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local - https://www.mandiant.com/resources/telegram-malware-iranian-espionage - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject author: Florian Roth (Nextron Systems) date: 2022-02-25 modified: 2023-03-08 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.discovery - attack.t1047 - attack.t1053 - attack.t1059.003 - attack.t1059.001 - attack.t1110 - attack.t1201 logsource: category: process_creation product: windows detection: selection_binary: Image|endswith: \crackmapexec.exe selection_special: CommandLine|contains: ' -M pe_inject ' selection_execute: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -x ' selection_hash: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -p ' - ' -H ''NTHASH''' selection_module_mssql: CommandLine|contains|all: - ' mssql ' - ' -u ' - ' -p ' - ' -M ' - ' -d ' selection_module_smb1: CommandLine|contains|all: - ' smb ' - ' -u ' - ' -H ' - ' -M ' - ' -o ' selection_module_smb2: CommandLine|contains|all: - ' smb ' - ' -u ' - ' -p ' - ' --local-auth' part_localauth_1: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -p ' part_localauth_2: CommandLine|contains|all: - ' 10.' - ' 192.168.' - '/24 ' condition: 1 of selection_* or all of part_localauth* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the. Logsource: windows / registry_set. Rule: title: Potential Credential Dumping Attempt Using New NetworkProvider - REG id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701 related: - id: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77 type: similar status: test description: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it references: - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-23 modified: 2023-08-17 tags: - attack.credential-access - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \System\CurrentControlSet\Services\ - \NetworkProvider filter: TargetObject|contains: - \System\CurrentControlSet\Services\WebClient\NetworkProvider - \System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider - \System\CurrentControlSet\Services\RDPNP\NetworkProvider filter_valid_procs: Image: C:\Windows\System32\poqexec.exe condition: selection and not 1 of filter* falsepositives: - Other legitimate network providers used and not filtred in this rule level: medium