Query: detection rule: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script
Matching passage: Sigma rule: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script. Logsource: windows / process_creation. Rule: title: PUA - PingCastle Execution From Potentially Suspicious Parent id: b37998de-a70b-4f33-b219-ec36bf433dc0 related: - id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c type: derived status: test description: 'Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location. ' references: - https://github.com/vletoux/pingcastle - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450 - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680 - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699 - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8 - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1 author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2024-01-11 tags: - attack.reconnaissance - attack.t1595 logsource: category: process_creation product: windows detection: selection_parent_ext: ParentCommandLine|contains: - .bat - .chm - .cmd - .hta - .htm - .html - .js - .lnk - .ps1 - .vbe - .vbs - .wsf selection_parent_path_1: ParentCommandLine|contains: - :\Perflogs\ - :\Temp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp - \AppData\Roaming\ - \Temporary Internet selection_parent_path_2: - ParentCommandLine|contains|all: - :\Users\ - \Favorites\ - ParentCommandLine|contains|all: - :\Users\ - \Favourites\ - ParentCommandLine|contains|all: - :\Users\ - \Contacts\ selection_cli: - Image|endswith: \PingCastle.exe - OriginalFileName: PingCastle.exe - Product: Ping Castle - CommandLine|contains: - --scanner aclcheck - --scanner antivirus - --scanner computerversion - --scanner foreignusers - --scanner laps_bitlocker - --scanner localadmin - --scanner nullsession - --scanner nullsession-trust - --scanner oxidbindings - --scanner remote - --scanner share - --scanner smb - --scanner smb3querynetwork - --scanner spooler - --scanner startup - --scanner zerologon - CommandLine|contains: --no-enum-limit - CommandLine|contains|all: - --healthcheck - --level Full - CommandLine|contains|all:
Near-miss passage: Sigma rule: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Visual Studio Tools for Office id: 9d15044a-7cfe-4d23-8085-6ebc11df7685 status: test description: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications. references: - https://twitter.com/_vivami/status/1347925307643355138 - https://vanmieghem.io/stealth-outlook-persistence/ author: Bhabesh Raj date: 2021-01-10 modified: 2026-01-09 tags: - attack.t1137.006 - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Software\Microsoft\Office\Outlook\Addins\ - \Software\Microsoft\Office\Word\Addins\ - \Software\Microsoft\Office\Excel\Addins\ - \Software\Microsoft\Office\Powerpoint\Addins\ - \Software\Microsoft\VSTO\Security\Inclusion\ filter_main_system: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe - C:\Windows\System32\regsvr32.exe - C:\Windows\SysWOW64\regsvr32.exe filter_main_office_click_to_run: Image|startswith: - C:\Program Files\Common Files (x86)\Microsoft Shared\ClickToRun\ - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_integrator: Image: - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe - C:\Program Files\Microsoft Office\root\integration\integrator.exe filter_main_office_apps: Image|startswith: - C:\Program Files\Microsoft Office\OFFICE - C:\Program Files (x86)\Microsoft Office\OFFICE - C:\Program Files\Microsoft Office\Root\OFFICE - C:\Program Files (x86)\Microsoft Office\Root\OFFICE - C:\PROGRA~2\MICROS~2\Office Image|endswith: - \excel.exe - \Integrator.exe - \OneNote.exe - \outlook.exe - \powerpnt.exe - \Teams.exe - \visio.exe - \winword.exe filter_main_vsto: Image|startswith: - C:\Program Files\Common Files\Microsoft Shared\VSTO\ - C:\Program Files (x86)\Microsoft Shared\VSTO\ Image|endswith: \VSTOInstaller.exe filter_optional_avg: Image: - C:\Program Files\AVG\Antivirus\RegSvr.exe - C:\Program Files (x86)\AVG\Antivirus\RegSvr.exe TargetObject|contains: \Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\ filter_optional_avast: Image: - C:\Program Files\Avast Software\Avast\RegSvr.exe - C:\Program Files (x86)\Avast Software\Avast\RegSvr.exe TargetObject|contains: \Microsoft\Office\Outlook\Addins\Avast.AsOutExt\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate Addin Installation level: medium