{"id":"4627c6ae-6899-46e2-aa0c-6ebcb1becd19","title":"HackTool - Impacket Tools Execution","description":"Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-07-24","modified":"2023-02-07","tags":["attack.collection","attack.execution","attack.credential-access","attack.t1557.001"],"technique_ids":["T1557.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate use of the impacket tools"],"references":["https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_impacket_tools.yml","source_sha256":"516eebfdfbe1a707df54b5f32b9bbbddf5a8411fa38281050578b7277c2e4468","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_impacket_tools.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Impacket Tools Execution\nid: 4627c6ae-6899-46e2-aa0c-6ebcb1becd19\nstatus: test\ndescription: Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)\nreferences:\n    - https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-07-24\nmodified: 2023-02-07\ntags:\n    - attack.collection\n    - attack.execution\n    - attack.credential-access\n    - attack.t1557.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|contains:\n              - '\\goldenPac'\n              - '\\karmaSMB'\n              - '\\kintercept'\n              - '\\ntlmrelayx'\n              - '\\rpcdump'\n              - '\\samrdump'\n              - '\\secretsdump'\n              - '\\smbexec'\n              - '\\smbrelayx'\n              - '\\wmiexec'\n              - '\\wmipersist'\n        - Image|endswith:\n              - '\\atexec_windows.exe'\n              - '\\dcomexec_windows.exe'\n              - '\\dpapi_windows.exe'\n              - '\\findDelegation_windows.exe'\n              - '\\GetADUsers_windows.exe'\n              - '\\GetNPUsers_windows.exe'\n              - '\\getPac_windows.exe'\n              - '\\getST_windows.exe'\n              - '\\getTGT_windows.exe'\n              - '\\GetUserSPNs_windows.exe'\n              - '\\ifmap_windows.exe'\n              - '\\mimikatz_windows.exe'\n              - '\\netview_windows.exe'\n              - '\\nmapAnswerMachine_windows.exe'\n              - '\\opdump_windows.exe'\n              - '\\psexec_windows.exe'\n              - '\\rdp_check_windows.exe'\n              - '\\sambaPipe_windows.exe'\n              - '\\smbclient_windows.exe'\n              - '\\smbserver_windows.exe'\n              - '\\sniff_windows.exe'\n              - '\\sniffer_windows.exe'\n              - '\\split_windows.exe'\n              - '\\ticketer_windows.exe'\n              # - '\\addcomputer_windows.exe'\n              # - '\\esentutl_windows.exe'\n              # - '\\getArch_windows.exe'\n              # - '\\lookupsid_windows.exe'\n              # - '\\mqtt_check_windows.exe'\n              # - '\\mssqlclient_windows.exe'\n              # - '\\mssqlinstance_windows.exe'\n              # - '\\ntfs-read_windows.exe'\n              # - '\\ping_windows.exe'\n              # - '\\ping6_windows.exe'\n              # - '\\raiseChild_windows.exe'\n              # - '\\reg_windows.exe'\n              # - '\\registry-read_windows.exe'\n              # - '\\services_windows.exe'\n              # - '\\wmiquery_windows.exe'\n    condition: selection\nfalsepositives:\n    - Legitimate use of the impacket tools\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1557.001","id":"T1557.001","name":"Name Resolution Poisoning and SMB Relay","page":"techniques/enterprise/T1557.001/"}],"data_path":"data/detection-rules/4627c6ae-6899-46e2-aa0c-6ebcb1becd19.json","kind":"sigma"}