{"id":"98b53e78-ebaf-46f8-be06-421aafd176d9","title":"HackTool - winPEAS Execution","description":"WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz","author":"Georg Lauenstein (sure[secure])","status":"test","level":"high","date":"2022-09-19","modified":"2023-03-23","tags":["attack.privilege-escalation","attack.discovery","attack.t1082","attack.t1087","attack.t1046"],"technique_ids":["T1046","T1082","T1087"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://github.com/carlospolop/PEASS-ng","https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_winpeas.yml","source_sha256":"8cb0a27037e870b40f94066fd8cc994cada53fe80c89eafeee677fcb399d6c3d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_winpeas.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - winPEAS Execution\nid: 98b53e78-ebaf-46f8-be06-421aafd176d9\nstatus: test\ndescription: WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz\nreferences:\n    - https://github.com/carlospolop/PEASS-ng\n    - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation\nauthor: Georg Lauenstein (sure[secure])\ndate: 2022-09-19\nmodified: 2023-03-23\ntags:\n    - attack.privilege-escalation\n    - attack.discovery\n    - attack.t1082\n    - attack.t1087\n    - attack.t1046\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - OriginalFileName: 'winPEAS.exe'\n        - Image|endswith:\n              - '\\winPEASany_ofs.exe'\n              - '\\winPEASany.exe'\n              - '\\winPEASx64_ofs.exe'\n              - '\\winPEASx64.exe'\n              - '\\winPEASx86_ofs.exe'\n              - '\\winPEASx86.exe'\n    selection_cli_option:\n        CommandLine|contains:\n            - ' applicationsinfo' # Search installed applications information\n            - ' browserinfo' # Search browser information\n            - ' eventsinfo' # Display interesting events information\n            - ' fileanalysis' # Search specific files that can contains credentials and for regexes inside files\n            - ' filesinfo' # Search generic files that can contains credentials\n            - ' processinfo' # Search processes information\n            - ' servicesinfo' # Search services information\n            - ' windowscreds' # Search windows credentials\n    selection_cli_dl:\n        CommandLine|contains: 'https://github.com/carlospolop/PEASS-ng/releases/latest/download/'\n    selection_cli_specific:\n        - ParentCommandLine|endswith: ' -linpeas'\n        - CommandLine|endswith: ' -linpeas'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1046","id":"T1046","name":"Network Service Discovery","page":"techniques/enterprise/T1046/"},{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"},{"key":"enterprise/T1087","id":"T1087","name":"Account Discovery","page":"techniques/enterprise/T1087/"}],"data_path":"data/detection-rules/98b53e78-ebaf-46f8-be06-421aafd176d9.json","kind":"sigma"}