Query: Sigma rule for This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been re
Matching passage: Sigma rule: This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been re. Logsource: windows / process_creation. Rule: title: HackTool - CrackMapExec Execution id: 42a993dd-bb3e-48c8-b372-4d6684c4106c status: test description: This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced. references: - https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local - https://www.mandiant.com/resources/telegram-malware-iranian-espionage - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject author: Florian Roth (Nextron Systems) date: 2022-02-25 modified: 2023-03-08 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.discovery - attack.t1047 - attack.t1053 - attack.t1059.003 - attack.t1059.001 - attack.t1110 - attack.t1201 logsource: category: process_creation product: windows detection: selection_binary: Image|endswith: \crackmapexec.exe selection_special: CommandLine|contains: ' -M pe_inject ' selection_execute: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -x ' selection_hash: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -p ' - ' -H ''NTHASH''' selection_module_mssql: CommandLine|contains|all: - ' mssql ' - ' -u ' - ' -p ' - ' -M ' - ' -d ' selection_module_smb1: CommandLine|contains|all: - ' smb ' - ' -u ' - ' -H ' - ' -M ' - ' -o ' selection_module_smb2: CommandLine|contains|all: - ' smb ' - ' -u ' - ' -p ' - ' --local-auth' part_localauth_1: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -p ' part_localauth_2: CommandLine|contains|all: - ' 10.' - ' 192.168.' - '/24 ' condition: 1 of selection_* or all of part_localauth* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LS. Logsource: windows / process_access. Rule: title: LSASS Access From Potentially White-Listed Processes id: 4be8b654-0c01-4c9d-a10c-6b28467fc651 status: test description: 'Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference ' references: - https://twitter.com/_xpn_/status/1491557187168178176 - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz - https://twitter.com/mrd0x/status/1460597833917251595 author: Florian Roth (Nextron Systems) date: 2022-02-10 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|endswith: - \TrolleyExpress.exe - \ProcessDump.exe - \dump64.exe GrantedAccess|endswith: - '10' - '30' - '50' - '70' - '90' - B0 - D0 - F0 - '18' - '38' - '58' - '78' - '98' - B8 - D8 - F8 - 1A - 3A - 5A - 7A - 9A - BA - DA - FA - '0x14C2' - FF condition: selection falsepositives: - Unknown level: high