{"id":"2433a154-bb3d-42e4-86c3-a26bdac91c45","title":"Renamed PingCastle Binary Execution","description":"Detects the execution of a renamed \"PingCastle\" binary based on the PE metadata fields.","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","status":"test","level":"high","date":"2024-01-11","modified":"","tags":["attack.execution","attack.stealth","attack.t1059","attack.t1202"],"technique_ids":["T1059","T1202"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/","https://www.pingcastle.com/documentation/scanner/"],"source_path":"rules/windows/process_creation/proc_creation_win_renamed_pingcastle.yml","source_sha256":"57d06ad9a12236ff6c84109ae48f6ab09a7272e48812af963fb21444015ebcf4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_pingcastle.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Renamed PingCastle Binary Execution\nid: 2433a154-bb3d-42e4-86c3-a26bdac91c45\nstatus: test\ndescription: Detects the execution of a renamed \"PingCastle\" binary based on the PE metadata fields.\nreferences:\n    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/\n    - https://www.pingcastle.com/documentation/scanner/\nauthor: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)\ndate: 2024-01-11\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059\n    - attack.t1202\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - OriginalFileName:\n              - 'PingCastleReporting.exe'\n              - 'PingCastleCloud.exe'\n              - 'PingCastle.exe'\n        - CommandLine|contains:\n              - '--scanner aclcheck'\n              - '--scanner antivirus'\n              - '--scanner computerversion'\n              - '--scanner foreignusers'\n              - '--scanner laps_bitlocker'\n              - '--scanner localadmin'\n              - '--scanner nullsession'\n              - '--scanner nullsession-trust'\n              - '--scanner oxidbindings'\n              - '--scanner remote'\n              - '--scanner share'\n              - '--scanner smb'\n              - '--scanner smb3querynetwork'\n              - '--scanner spooler'\n              - '--scanner startup'\n              - '--scanner zerologon'\n        - CommandLine|contains: '--no-enum-limit'\n        - CommandLine|contains|all:\n              - '--healthcheck'\n              - '--level Full'\n        - CommandLine|contains|all:\n              - '--healthcheck'\n              - '--server '\n    filter_main_img:\n        Image|endswith:\n            - '\\PingCastleReporting.exe'\n            - '\\PingCastleCloud.exe'\n            - '\\PingCastle.exe'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","page":"techniques/enterprise/T1202/"}],"data_path":"data/detection-rules/2433a154-bb3d-42e4-86c3-a26bdac91c45.json","kind":"sigma"}