Query: detect Detects different hacktools used for relay attacks on Windows for privilege escalation in logs
Matching passage: Sigma rule: Detects different hacktools used for relay attacks on Windows for privilege escalation. Logsource: windows / process_creation. Rule: title: Potential SMB Relay Attack Tool Execution id: 5589ab4f-a767-433c-961d-c91f3f704db1 status: test description: Detects different hacktools used for relay attacks on Windows for privilege escalation references: - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/ - https://pentestlab.blog/2017/04/13/hot-potato/ - https://github.com/ohpe/juicy-potato - https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes - https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire - https://www.localpotato.com/ author: Florian Roth (Nextron Systems) date: 2021-07-24 modified: 2023-02-14 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection_pe: Image|contains: - PetitPotam - RottenPotato - HotPotato - JuicyPotato - \just_dce_ - Juicy Potato - \temp\rot.exe - \Potato.exe - \SpoolSample.exe - \Responder.exe - \smbrelayx - \ntlmrelayx - \LocalPotato selection_script: CommandLine|contains: - Invoke-Tater - ' smbrelay' - ' ntlmrelay' - 'cme smb ' - ' /ntlm:NTLMhash ' - Invoke-PetitPotam - '.exe -t * -p ' selection_juicypotato_enum: CommandLine|contains: .exe -c "{ CommandLine|endswith: '}" -z' filter_hotpotatoes: Image|contains: - HotPotatoes6 - HotPotatoes7 - 'HotPotatoes ' condition: 1 of selection_* and not 1 of filter_* falsepositives: - Legitimate files with these rare hacktool names level: critical
Near-miss passage: Sigma rule: Detects when a repository or an organization is being transferred to another location.. Logsource: github / audit. Rule: title: Github Repository/Organization Transferred id: 04ad83ef-1a37-4c10-b57a-81092164bf33 status: test description: Detects when a repository or an organization is being transferred to another location. references: - https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository - https://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership - https://docs.github.com/en/migrations - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration author: Romain Gaillard (@romain-gaillard) date: 2024-07-29 tags: - attack.persistence - attack.exfiltration - attack.t1020 - attack.t1537 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - migration.create - org.transfer_outgoing - org.transfer - repo.transfer_outgoing condition: selection falsepositives: - Allowed administrative activities. level: medium