{"id":"cf0c254b-22f1-4b2b-8221-e137b3c0af94","title":"HackTool - Impersonate Execution","description":"Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively","author":"Sai Prashanth Pulisetti @pulisettis","status":"test","level":"medium","date":"2022-12-21","modified":"2024-11-23","tags":["attack.privilege-escalation","attack.stealth","attack.t1134.001","attack.t1134.003"],"technique_ids":["T1134.001","T1134.003"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/","https://github.com/sensepost/impersonate"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_impersonate.yml","source_sha256":"bd422b949bf0e7b70f1c6d8dbc8ffd5b1b1ce232ac34f1fddc9ab33df5ad8902","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_impersonate.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Impersonate Execution\nid: cf0c254b-22f1-4b2b-8221-e137b3c0af94\nstatus: test\ndescription: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively\nreferences:\n    - https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/\n    - https://github.com/sensepost/impersonate\nauthor: Sai Prashanth Pulisetti @pulisettis\ndate: 2022-12-21\nmodified: 2024-11-23\ntags:\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1134.001\n    - attack.t1134.003\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_commandline_exe:\n        CommandLine|contains: 'impersonate.exe'\n    selection_commandline_opt:\n        CommandLine|contains:\n            - ' list '\n            - ' exec '\n            - ' adduser '\n    selection_hash:\n        Hashes|contains:\n            - 'MD5=9520714AB576B0ED01D1513691377D01'\n            - 'SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A'\n            - 'IMPHASH=0A358FFC1697B7A07D0E817AC740DF62'\n    condition: all of selection_commandline_* or selection_hash\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1134.001","id":"T1134.001","name":"Token Impersonation/Theft","page":"techniques/enterprise/T1134.001/"},{"key":"enterprise/T1134.003","id":"T1134.003","name":"Make and Impersonate Token","page":"techniques/enterprise/T1134.003/"}],"data_path":"data/detection-rules/cf0c254b-22f1-4b2b-8221-e137b3c0af94.json","kind":"sigma"}