Query: Sigma rule for Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.
Matching passage: Sigma rule: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.. Logsource: windows / process_creation. Rule: title: PUA - PingCastle Execution id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c related: - id: b37998de-a70b-4f33-b219-ec36bf433dc0 type: derived status: test description: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level. references: - https://github.com/vletoux/pingcastle - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450 - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680 - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699 - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8 - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1 author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-01-11 tags: - attack.reconnaissance - attack.t1595 logsource: category: process_creation product: windows detection: selection: - Hashes|contains: - MD5=f741f25ac909ee434e50812d436c73ff - MD5=d40acbfc29ee24388262e3d8be16f622 - MD5=01bb2c16fadb992fa66228cd02d45c60 - MD5=9e1b18e62e42b5444fc55b51e640355b - MD5=b7f8fe33ac471b074ca9e630ba0c7e79 - MD5=324579d717c9b9b8e71d0269d13f811f - MD5=63257a1ddaf83cfa43fe24a3bc06c207 - MD5=049e85963826b059c9bac273bb9c82ab - MD5=ecb98b7b4d4427eb8221381154ff4cb2 - MD5=faf87749ac790ec3a10dd069d10f9d63 - MD5=f296dba5d21ad18e6990b1992aea8f83 - MD5=93ba94355e794b6c6f98204cf39f7a11 - MD5=a258ef593ac63155523a461ecc73bdba - MD5=97000eb5d1653f1140ee3f47186463c4 - MD5=95eb317fbbe14a82bd9fdf31c48b8d93 - MD5=32fe9f0d2630ac40ea29023920f20f49 - MD5=a05930dde939cfd02677fc18bb2b7df5 - MD5=124283924e86933ff9054a549d3a268b - MD5=ceda6909b8573fdeb0351c6920225686 - MD5=60ce120040f2cd311c810ae6f6bbc182 - MD5=2f10cdc5b09100a260703a28eadd0ceb - MD5=011d967028e797a4c16d547f7ba1463f - MD5=2da9152c0970500c697c1c9b4a9e0360 - MD5=b5ba72034b8f44d431f55275bace9f8b - MD5=d6ed9101df0f24e27ff92ddab42dacca - MD5=3ed3cdb6d12aa1ac562ad185cdbf2d1d - MD5=5e083cd0143ae95a6cb79b68c07ca573 - MD5=28caff93748cb84be70486e79f04c2df - MD5=9d4f12c30f9b500f896efd1800e4dd11 - MD5=4586f7dd14271ad65a5fb696b393f4c0 - MD5=86ba9dddbdf49215145b5bcd081d4011 - MD5=9dce0a481343874ef9a36
Near-miss passage: Sigma rule: Detects the creation of a office macro file from a a suspicious process. Logsource: windows / file_event. Rule: title: Office Macro File Creation From Suspicious Process id: b1c50487-1967-4315-a026-6491686d860e status: test description: Detects the creation of a office macro file from a a suspicious process references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2023-02-22 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data' detection: selection_cmd: - Image|endswith: - \cscript.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - ParentImage|endswith: - \cscript.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_ext: TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm condition: all of selection_* falsepositives: - Unknown level: high