Query: write Sigma for Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their na
Matching passage: Sigma rule: Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their na. Logsource: windows / process_creation. Rule: title: HackTool - Impacket Tools Execution id: 4627c6ae-6899-46e2-aa0c-6ebcb1becd19 status: test description: Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives) references: - https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries author: Florian Roth (Nextron Systems) date: 2021-07-24 modified: 2023-02-07 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection: - Image|contains: - \goldenPac - \karmaSMB - \kintercept - \ntlmrelayx - \rpcdump - \samrdump - \secretsdump - \smbexec - \smbrelayx - \wmiexec - \wmipersist - Image|endswith: - \atexec_windows.exe - \dcomexec_windows.exe - \dpapi_windows.exe - \findDelegation_windows.exe - \GetADUsers_windows.exe - \GetNPUsers_windows.exe - \getPac_windows.exe - \getST_windows.exe - \getTGT_windows.exe - \GetUserSPNs_windows.exe - \ifmap_windows.exe - \mimikatz_windows.exe - \netview_windows.exe - \nmapAnswerMachine_windows.exe - \opdump_windows.exe - \psexec_windows.exe - \rdp_check_windows.exe - \sambaPipe_windows.exe - \smbclient_windows.exe - \smbserver_windows.exe - \sniff_windows.exe - \sniffer_windows.exe - \split_windows.exe - \ticketer_windows.exe condition: selection falsepositives: - Legitimate use of the impacket tools level: high
Near-miss passage: Sigma rule: Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled ta. Logsource: windows / taskscheduler. Rule: title: Important Scheduled Task Deleted or Disabled id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d related: - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 type: similar - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad type: similar - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 type: similar status: test description: 'Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities ' references: - https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/ author: frack113 date: 2023-01-13 modified: 2026-03-11 tags: - attack.impact - attack.t1489 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: - 141 - 142 TaskName|contains: - \Windows\SystemRestore\SR - \Windows\Windows Defender\ - \Windows\BitLocker - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ - \Windows\UpdateOrchestrator\ - \Windows\ExploitGuard filter_main_user: UserName|contains: - AUTHORI - AUTORI condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034