Query: rule covering Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercin
Matching passage: Sigma rule: Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercin. Logsource: windows / process_creation. Rule: title: HackTool - ADCSPwn Execution id: cd8c163e-a19b-402e-bdd5-419ff5859f12 status: test description: Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service references: - https://github.com/bats3c/ADCSPwn author: Florian Roth (Nextron Systems) date: 2021-07-31 modified: 2023-02-04 tags: - attack.collection - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' --adcs ' - ' --port ' condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Shadow Copies deletion using operating systems utilities. Logsource: windows / process_creation. Rule: title: Shadow Copies Deletion Using Operating Systems Utilities id: c947b146-0abc-4c87-9c64-b17e9d7274a2 status: stable description: Shadow Copies deletion using operating systems utilities references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://blog.talosintelligence.com/2017/05/wannacry.html - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/ - https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/ - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100 - https://github.com/Neo23x0/Raccine#the-process - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar - https://redcanary.com/blog/intelligence-insights-october-2021/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades) date: 2019-10-22 modified: 2022-11-03 tags: - attack.impact - attack.stealth - attack.t1070 - attack.t1490 logsource: category: process_creation product: windows detection: selection1_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \wmic.exe - \vssadmin.exe - \diskshadow.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - wmic.exe - VSSADMIN.EXE - diskshadow.exe selection1_cli: CommandLine|contains|all: - shadow - delete selection2_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection2_cli: CommandLine|contains|all: - delete - catalog - quiet selection3_img: - Image|endswith: \vssadmin.exe - OriginalFileName: VSSADMIN.EXE selection3_cli: CommandLine|contains|all: - resize - shadowstorage CommandLine|contains: - unbounded - /MaxSize= condition: (all of selection1*) or (all of selection2*) or (all of selection3*) falsepositives: - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason - LANDesk LDClient Ivanti-PSModule (PS EncodedCommand) level: high