Florian Roth
73 lines
2.4 KiB
YAML
73 lines
2.4 KiB
YAML
title: Impacket Tool Execution
|
|
status: experimental
|
|
id: 4627c6ae-6899-46e2-aa0c-6ebcb1becd19
|
|
description: Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)
|
|
author: Florian Roth
|
|
date: 2021/07/24
|
|
references:
|
|
- https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries
|
|
tags:
|
|
- attack.execution
|
|
- attack.t1557.001
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
detection:
|
|
selection:
|
|
- Image|contains:
|
|
- '\goldenPac'
|
|
- '\karmaSMB'
|
|
- '\kintercept'
|
|
- '\ntlmrelayx'
|
|
- '\rpcdump'
|
|
- '\samrdump'
|
|
- '\secretsdump'
|
|
- '\smbexec'
|
|
- '\smbrelayx'
|
|
- '\wmiexec'
|
|
- '\wmipersist'
|
|
- Image|endswith:
|
|
# - '\addcomputer_windows.exe'
|
|
- '\atexec_windows.exe'
|
|
- '\dcomexec_windows.exe'
|
|
- '\dpapi_windows.exe'
|
|
# - '\esentutl_windows.exe'
|
|
- '\findDelegation_windows.exe'
|
|
- '\GetADUsers_windows.exe'
|
|
# - '\getArch_windows.exe'
|
|
- '\GetNPUsers_windows.exe'
|
|
- '\getPac_windows.exe'
|
|
- '\getST_windows.exe'
|
|
- '\getTGT_windows.exe'
|
|
- '\GetUserSPNs_windows.exe'
|
|
- '\ifmap_windows.exe'
|
|
# - '\lookupsid_windows.exe'
|
|
- '\mimikatz_windows.exe'
|
|
# - '\mqtt_check_windows.exe'
|
|
# - '\mssqlclient_windows.exe'
|
|
# - '\mssqlinstance_windows.exe'
|
|
- '\netview_windows.exe'
|
|
- '\nmapAnswerMachine_windows.exe'
|
|
#- '\ntfs-read_windows.exe'
|
|
- '\opdump_windows.exe'
|
|
# - '\ping6_windows.exe'
|
|
# - '\ping_windows.exe'
|
|
- '\psexec_windows.exe'
|
|
# - '\raiseChild_windows.exe'
|
|
- '\rdp_check_windows.exe'
|
|
#- '\registry-read_windows.exe'
|
|
#- '\reg_windows.exe'
|
|
- '\sambaPipe_windows.exe'
|
|
# - '\services_windows.exe'
|
|
- '\smbclient_windows.exe'
|
|
- '\smbserver_windows.exe'
|
|
- '\sniffer_windows.exe'
|
|
- '\sniff_windows.exe'
|
|
- '\split_windows.exe'
|
|
- '\ticketer_windows.exe'
|
|
# - '\wmiquery_windows.exe'
|
|
condition: selection
|
|
falsepositives:
|
|
- Legitimate use of the impacket tools
|
|
level: high
|