{"id":"d0d2f720-d14f-448d-8242-51ff396a334e","title":"HackTool - Generic Process Access","description":"Detects process access requests from hacktool processes based on their default image name","author":"Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-11-27","modified":"","tags":["attack.credential-access","attack.t1003.001","attack.s0002"],"technique_ids":["T1003.001"],"logsource":{"category":"process_access","product":"windows"},"falsepositives":["Unlikely"],"references":["https://jsecurity101.medium.com/bypassing-access-mask-auditing-strategies-480fb641c158","https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html"],"source_path":"rules/windows/process_access/proc_access_win_hktl_generic_access.yml","source_sha256":"0c4d8c1cd06af8d6838ab7f5f38015380445d2de1092a788cc0154e78d10e9b2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_hktl_generic_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Generic Process Access\nid: d0d2f720-d14f-448d-8242-51ff396a334e\nstatus: test\ndescription: Detects process access requests from hacktool processes based on their default image name\nreferences:\n    - https://jsecurity101.medium.com/bypassing-access-mask-auditing-strategies-480fb641c158\n    - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html\nauthor: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel\ndate: 2023-11-27\ntags:\n    - attack.credential-access\n    - attack.t1003.001\n    - attack.s0002\nlogsource:\n    category: process_access\n    product: windows\ndetection:\n    selection:\n        - SourceImage|endswith:\n              - '\\Akagi.exe'\n              - '\\Akagi64.exe'\n              - '\\atexec_windows.exe'\n              - '\\Certify.exe'\n              - '\\Certipy.exe'\n              - '\\CoercedPotato.exe'\n              - '\\crackmapexec.exe'\n              - '\\CreateMiniDump.exe'\n              - '\\dcomexec_windows.exe'\n              - '\\dpapi_windows.exe'\n              - '\\findDelegation_windows.exe'\n              - '\\GetADUsers_windows.exe'\n              - '\\GetNPUsers_windows.exe'\n              - '\\getPac_windows.exe'\n              - '\\getST_windows.exe'\n              - '\\getTGT_windows.exe'\n              - '\\GetUserSPNs_windows.exe'\n              - '\\gmer.exe'\n              - '\\hashcat.exe'\n              - '\\htran.exe'\n              - '\\ifmap_windows.exe'\n              - '\\impersonate.exe'\n              - '\\Inveigh.exe'\n              - '\\LocalPotato.exe'\n              - '\\mimikatz_windows.exe'\n              - '\\mimikatz.exe'\n              - '\\netview_windows.exe'\n              - '\\nmapAnswerMachine_windows.exe'\n              - '\\opdump_windows.exe'\n              - '\\PasswordDump.exe'\n              - '\\Potato.exe'\n              - '\\PowerTool.exe'\n              - '\\PowerTool64.exe'\n              - '\\psexec_windows.exe'\n              - '\\PurpleSharp.exe'\n              - '\\pypykatz.exe'\n              - '\\QuarksPwDump.exe'\n              - '\\rdp_check_windows.exe'\n              - '\\Rubeus.exe'\n              - '\\SafetyKatz.exe'\n              - '\\sambaPipe_windows.exe'\n              - '\\SelectMyParent.exe'\n              - '\\SharpChisel.exe'\n              - '\\SharPersist.exe'\n              - '\\SharpEvtMute.exe'\n              - '\\SharpImpersonation.exe'\n              - '\\SharpLDAPmonitor.exe'\n              - '\\SharpLdapWhoami.exe'\n              - '\\SharpUp.exe'\n              - '\\SharpView.exe'\n              - '\\smbclient_windows.exe'\n              - '\\smbserver_windows.exe'\n              - '\\sniff_windows.exe'\n              - '\\sniffer_windows.exe'\n              - '\\split_windows.exe'\n              - '\\SpoolSample.exe'\n              - '\\Stracciatella.exe'\n              - '\\SysmonEOP.exe'\n              - '\\temp\\rot.exe'\n              - '\\ticketer_windows.exe'\n              - '\\TruffleSnout.exe'\n              - '\\winPEASany_ofs.exe'\n              - '\\winPEASany.exe'\n              - '\\winPEASx64_ofs.exe'\n              - '\\winPEASx64.exe'\n              - '\\winPEASx86_ofs.exe'\n              - '\\winPEASx86.exe'\n              - '\\xordump.exe'\n        - SourceImage|contains:\n              - '\\goldenPac'\n              - '\\just_dce_'\n              - '\\karmaSMB'\n              - '\\kintercept'\n              - '\\LocalPotato'\n              - '\\ntlmrelayx'\n              - '\\rpcdump'\n              - '\\samrdump'\n              - '\\secretsdump'\n              - '\\smbexec'\n              - '\\smbrelayx'\n              - '\\wmiexec'\n              - '\\wmipersist'\n              - 'HotPotato'\n              - 'Juicy Potato'\n              - 'JuicyPotato'\n              - 'PetitPotam'\n              - 'RottenPotato'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/d0d2f720-d14f-448d-8242-51ff396a334e.json","kind":"sigma"}