Query: Sigma rule for Detects different hacktools used for relay attacks on Windows for privilege escalation
Matching passage: Sigma rule: Detects different hacktools used for relay attacks on Windows for privilege escalation. Logsource: windows / process_creation. Rule: title: Potential SMB Relay Attack Tool Execution id: 5589ab4f-a767-433c-961d-c91f3f704db1 status: test description: Detects different hacktools used for relay attacks on Windows for privilege escalation references: - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/ - https://pentestlab.blog/2017/04/13/hot-potato/ - https://github.com/ohpe/juicy-potato - https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes - https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire - https://www.localpotato.com/ author: Florian Roth (Nextron Systems) date: 2021-07-24 modified: 2023-02-14 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection_pe: Image|contains: - PetitPotam - RottenPotato - HotPotato - JuicyPotato - \just_dce_ - Juicy Potato - \temp\rot.exe - \Potato.exe - \SpoolSample.exe - \Responder.exe - \smbrelayx - \ntlmrelayx - \LocalPotato selection_script: CommandLine|contains: - Invoke-Tater - ' smbrelay' - ' ntlmrelay' - 'cme smb ' - ' /ntlm:NTLMhash ' - Invoke-PetitPotam - '.exe -t * -p ' selection_juicypotato_enum: CommandLine|contains: .exe -c "{ CommandLine|endswith: '}" -z' filter_hotpotatoes: Image|contains: - HotPotatoes6 - HotPotatoes7 - 'HotPotatoes ' condition: 1 of selection_* and not 1 of filter_* falsepositives: - Legitimate files with these rare hacktool names level: critical
Near-miss passage: Sigma rule: Detects default CSExec pipe creation. Logsource: windows / pipe_created. Rule: title: PUA - CSExec Default Named Pipe id: f318b911-ea88-43f4-9281-0de23ede628e related: - id: 9e77ed63-2ecf-4c7b-b09d-640834882028 type: obsolete status: test description: Detects default CSExec pipe creation references: - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://github.com/malcomvetter/CSExec author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-08-07 modified: 2023-11-30 tags: - attack.lateral-movement - attack.t1021.002 - attack.execution - attack.t1569.002 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: \csexecsvc condition: selection falsepositives: - Legitimate Administrator activity level: medium