{"id":"903076ff-f442-475a-b667-4f246bcc203b","title":"Nltest.EXE Execution","description":"Detects nltest commands that can be used for information discovery","author":"Arun Chauhan","status":"test","level":"low","date":"2023-02-03","modified":"","tags":["attack.discovery","attack.t1016","attack.t1018","attack.t1482"],"technique_ids":["T1016","T1018","T1482"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate administration activity"],"references":["https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm"],"source_path":"rules/windows/process_creation/proc_creation_win_nltest_execution.yml","source_sha256":"1210867b8d10a3d3f10d34a95e80d7fa87240377e0ba4cb05b9859e56bb3c6f7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_nltest_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Nltest.EXE Execution\nid: 903076ff-f442-475a-b667-4f246bcc203b\nrelated:\n    - id: 5cc90652-4cbd-4241-aa3b-4b462fa5a248\n      type: similar\n    - id: eeb66bbb-3dde-4582-815a-584aee9fe6d1\n      type: obsolete\nstatus: test\ndescription: Detects nltest commands that can be used for information discovery\nreferences:\n    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm\nauthor: Arun Chauhan\ndate: 2023-02-03\ntags:\n    - attack.discovery\n    - attack.t1016\n    - attack.t1018\n    - attack.t1482\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|endswith: '\\nltest.exe'\n        - OriginalFileName: 'nltestrk.exe'\n    condition: selection\nfalsepositives:\n    - Legitimate administration activity\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1016","id":"T1016","name":"System Network Configuration Discovery","page":"techniques/enterprise/T1016/"},{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","page":"techniques/enterprise/T1018/"},{"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","page":"techniques/enterprise/T1482/"}],"data_path":"data/detection-rules/903076ff-f442-475a-b667-4f246bcc203b.json","kind":"sigma"}