Query: write Sigma for Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.
Matching passage: Sigma rule: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.. Logsource: windows / process_creation. Rule: title: PUA - PingCastle Execution id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c related: - id: b37998de-a70b-4f33-b219-ec36bf433dc0 type: derived status: test description: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level. references: - https://github.com/vletoux/pingcastle - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450 - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680 - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699 - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8 - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1 author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-01-11 tags: - attack.reconnaissance - attack.t1595 logsource: category: process_creation product: windows detection: selection: - Hashes|contains: - MD5=f741f25ac909ee434e50812d436c73ff - MD5=d40acbfc29ee24388262e3d8be16f622 - MD5=01bb2c16fadb992fa66228cd02d45c60 - MD5=9e1b18e62e42b5444fc55b51e640355b - MD5=b7f8fe33ac471b074ca9e630ba0c7e79 - MD5=324579d717c9b9b8e71d0269d13f811f - MD5=63257a1ddaf83cfa43fe24a3bc06c207 - MD5=049e85963826b059c9bac273bb9c82ab - MD5=ecb98b7b4d4427eb8221381154ff4cb2 - MD5=faf87749ac790ec3a10dd069d10f9d63 - MD5=f296dba5d21ad18e6990b1992aea8f83 - MD5=93ba94355e794b6c6f98204cf39f7a11 - MD5=a258ef593ac63155523a461ecc73bdba - MD5=97000eb5d1653f1140ee3f47186463c4 - MD5=95eb317fbbe14a82bd9fdf31c48b8d93 - MD5=32fe9f0d2630ac40ea29023920f20f49 - MD5=a05930dde939cfd02677fc18bb2b7df5 - MD5=124283924e86933ff9054a549d3a268b - MD5=ceda6909b8573fdeb0351c6920225686 - MD5=60ce120040f2cd311c810ae6f6bbc182 - MD5=2f10cdc5b09100a260703a28eadd0ceb - MD5=011d967028e797a4c16d547f7ba1463f - MD5=2da9152c0970500c697c1c9b4a9e0360 - MD5=b5ba72034b8f44d431f55275bace9f8b - MD5=d6ed9101df0f24e27ff92ddab42dacca - MD5=3ed3cdb6d12aa1ac562ad185cdbf2d1d - MD5=5e083cd0143ae95a6cb79b68c07ca573 - MD5=28caff93748cb84be70486e79f04c2df - MD5=9d4f12c30f9b500f896efd1800e4dd11 - MD5=4586f7dd14271ad65a5fb696b393f4c0 - MD5=86ba9dddbdf49215145b5bcd081d4011 - MD5=9dce0a481343874ef9a36
Near-miss passage: Sigma rule: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious ASP.NET Compilation Via AspNetCompiler id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation. references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 modified: 2025-02-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ Image|endswith: \aspnet_compiler.exe CommandLine|contains: - \Users\Public\ - \AppData\Local\Temp\ - \AppData\Local\Roaming\ - :\Temp\ - :\Windows\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ condition: selection falsepositives: - Unknown level: high