{"id":"b37998de-a70b-4f33-b219-ec36bf433dc0","title":"PUA - PingCastle Execution From Potentially Suspicious Parent","description":"Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.\n","author":"Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)","status":"test","level":"high","date":"2024-01-11","modified":"","tags":["attack.reconnaissance","attack.t1595"],"technique_ids":["T1595"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/vletoux/pingcastle","https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/","https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450","https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680","https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699","https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8","https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_pingcastle_script_parent.yml","source_sha256":"a35a1992bd235c704abd4b85758047d068fa26d5478fbc6b6fa87f2b139273fd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_pingcastle_script_parent.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - PingCastle Execution From Potentially Suspicious Parent\nid: b37998de-a70b-4f33-b219-ec36bf433dc0\nrelated:\n    - id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c\n      type: derived\nstatus: test\ndescription: |\n    Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.\nreferences:\n    - https://github.com/vletoux/pingcastle\n    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/\n    - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450\n    - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680\n    - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699\n    - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8\n    - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1\nauthor: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)\ndate: 2024-01-11\ntags:\n    - attack.reconnaissance\n    - attack.t1595\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent_ext:\n        ParentCommandLine|contains:\n            - '.bat'\n            - '.chm'\n            - '.cmd'\n            - '.hta'\n            - '.htm'\n            - '.html'\n            - '.js'\n            - '.lnk'\n            - '.ps1'\n            - '.vbe'\n            - '.vbs'\n            - '.wsf'\n    selection_parent_path_1:\n        ParentCommandLine|contains:\n            - ':\\Perflogs\\'\n            - ':\\Temp\\'\n            - ':\\Users\\Public\\'\n            - ':\\Windows\\Temp\\'\n            - '\\AppData\\Local\\Temp'\n            - '\\AppData\\Roaming\\'\n            - '\\Temporary Internet'\n    selection_parent_path_2:\n        - ParentCommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Favorites\\'\n        - ParentCommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Favourites\\'\n        - ParentCommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Contacts\\'\n    selection_cli:\n        - Image|endswith: '\\PingCastle.exe'\n        - OriginalFileName: PingCastle.exe\n        - Product: 'Ping Castle'\n        - CommandLine|contains:\n              - '--scanner aclcheck'\n              - '--scanner antivirus'\n              - '--scanner computerversion'\n              - '--scanner foreignusers'\n              - '--scanner laps_bitlocker'\n              - '--scanner localadmin'\n              - '--scanner nullsession'\n              - '--scanner nullsession-trust'\n              - '--scanner oxidbindings'\n              - '--scanner remote'\n              - '--scanner share'\n              - '--scanner smb'\n              - '--scanner smb3querynetwork'\n              - '--scanner spooler'\n              - '--scanner startup'\n              - '--scanner zerologon'\n        - CommandLine|contains: '--no-enum-limit'\n        - CommandLine|contains|all:\n              - '--healthcheck'\n              - '--level Full'\n        - CommandLine|contains|all:\n              - '--healthcheck'\n              - '--server '\n    condition: 1 of selection_parent_* and selection_parent_ext and selection_cli\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1595","id":"T1595","name":"Active Scanning","page":"techniques/enterprise/T1595/"}],"data_path":"data/detection-rules/b37998de-a70b-4f33-b219-ec36bf433dc0.json","kind":"sigma"}