detection.wiki

Detection rules › Sigma

HackTool - Generic Process Access

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
Source
upstream

Detects process access requests from hacktool processes based on their default image name

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.001 OS Credential Dumping: LSASS Memory

Event coverage

ProviderEvent IDTitle
Sysmon10ProcessAccess

Stages and Predicates

Stage 1: selection

or:
SourceImage|endswith: '\Akagi.exe'
SourceImage|endswith: '\Akagi64.exe'
SourceImage|endswith: '\Certify.exe'
SourceImage|endswith: '\Certipy.exe'
SourceImage|endswith: '\CoercedPotato.exe'
SourceImage|endswith: '\CreateMiniDump.exe'
SourceImage|endswith: '\GetADUsers_windows.exe'
SourceImage|endswith: '\GetNPUsers_windows.exe'
SourceImage|endswith: '\GetUserSPNs_windows.exe'
SourceImage|endswith: '\Inveigh.exe'
SourceImage|endswith: '\LocalPotato.exe'
SourceImage|endswith: '\PasswordDump.exe'
SourceImage|endswith: '\Potato.exe'
SourceImage|endswith: '\PowerTool.exe'
SourceImage|endswith: '\PowerTool64.exe'
SourceImage|endswith: '\PurpleSharp.exe'
SourceImage|endswith: '\QuarksPwDump.exe'
SourceImage|endswith: '\Rubeus.exe'
SourceImage|endswith: '\SafetyKatz.exe'
SourceImage|endswith: '\SelectMyParent.exe'
SourceImage|endswith: '\SharPersist.exe'
SourceImage|endswith: '\SharpChisel.exe'
SourceImage|endswith: '\SharpEvtMute.exe'
SourceImage|endswith: '\SharpImpersonation.exe'
SourceImage|endswith: '\SharpLDAPmonitor.exe'
SourceImage|endswith: '\SharpLdapWhoami.exe'
SourceImage|endswith: '\SharpUp.exe'
SourceImage|endswith: '\SharpView.exe'
SourceImage|endswith: '\SpoolSample.exe'
SourceImage|endswith: '\Stracciatella.exe'
SourceImage|endswith: '\SysmonEOP.exe'
SourceImage|endswith: '\TruffleSnout.exe'
SourceImage|endswith: '\atexec_windows.exe'
SourceImage|endswith: '\crackmapexec.exe'
SourceImage|endswith: '\dcomexec_windows.exe'
SourceImage|endswith: '\dpapi_windows.exe'
SourceImage|endswith: '\findDelegation_windows.exe'
SourceImage|endswith: '\getPac_windows.exe'
SourceImage|endswith: '\getST_windows.exe'
SourceImage|endswith: '\getTGT_windows.exe'
SourceImage|endswith: '\gmer.exe'
SourceImage|endswith: '\hashcat.exe'
SourceImage|endswith: '\htran.exe'
SourceImage|endswith: '\ifmap_windows.exe'
SourceImage|endswith: '\impersonate.exe'
SourceImage|endswith: '\mimikatz.exe'
SourceImage|endswith: '\mimikatz_windows.exe'
SourceImage|endswith: '\netview_windows.exe'
SourceImage|endswith: '\nmapAnswerMachine_windows.exe'
SourceImage|endswith: '\opdump_windows.exe'
SourceImage|endswith: '\psexec_windows.exe'
SourceImage|endswith: '\pypykatz.exe'
SourceImage|endswith: '\rdp_check_windows.exe'
SourceImage|endswith: '\sambaPipe_windows.exe'
SourceImage|endswith: '\smbclient_windows.exe'
SourceImage|endswith: '\smbserver_windows.exe'
SourceImage|endswith: '\sniff_windows.exe'
SourceImage|endswith: '\sniffer_windows.exe'
SourceImage|endswith: '\split_windows.exe'
SourceImage|endswith: '\temp\rot.exe'
SourceImage|endswith: '\ticketer_windows.exe'
SourceImage|endswith: '\winPEASany.exe'
SourceImage|endswith: '\winPEASany_ofs.exe'
SourceImage|endswith: '\winPEASx64.exe'
SourceImage|endswith: '\winPEASx64_ofs.exe'
SourceImage|endswith: '\winPEASx86.exe'
SourceImage|endswith: '\winPEASx86_ofs.exe'
SourceImage|endswith: '\xordump.exe'
SourceImage|contains: HotPotato
SourceImage|contains: 'Juicy Potato'
SourceImage|contains: JuicyPotato
SourceImage|contains: PetitPotam
SourceImage|contains: RottenPotato
SourceImage|contains: '\LocalPotato'
SourceImage|contains: '\goldenPac'
SourceImage|contains: '\just_dce_'
SourceImage|contains: '\karmaSMB'
SourceImage|contains: '\kintercept'
SourceImage|contains: '\ntlmrelayx'
SourceImage|contains: '\rpcdump'
SourceImage|contains: '\samrdump'
SourceImage|contains: '\secretsdump'
SourceImage|contains: '\smbexec'
SourceImage|contains: '\smbrelayx'
SourceImage|contains: '\wmiexec'
SourceImage|contains: '\wmipersist'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
SourceImageends_with
  • \Akagi.exe corpus 2 (sigma 2)
  • \Akagi64.exe corpus 2 (sigma 2)
  • \Certify.exe corpus 2 (sigma 2)
  • \Certipy.exe corpus 2 (sigma 2)
  • \CoercedPotato.exe corpus 2 (sigma 2)
  • \CreateMiniDump.exe corpus 2 (sigma 2)
  • \GetADUsers_windows.exe corpus 2 (sigma 2)
  • \GetNPUsers_windows.exe corpus 2 (sigma 2)
  • \GetUserSPNs_windows.exe corpus 2 (sigma 2)
  • \Inveigh.exe corpus 2 (sigma 2)
  • \LocalPotato.exe corpus 2 (sigma 2)
  • \PasswordDump.exe
  • \Potato.exe
  • \PowerTool.exe corpus 2 (sigma 2)
  • \PowerTool64.exe corpus 2 (sigma 2)
  • \PurpleSharp.exe
  • \QuarksPwDump.exe corpus 2 (sigma 2)
  • \Rubeus.exe corpus 2 (sigma 2)
  • \SafetyKatz.exe corpus 2 (sigma 2)
  • \SelectMyParent.exe corpus 2 (sigma 2)
  • \SharPersist.exe corpus 2 (sigma 2)
  • \SharpChisel.exe corpus 2 (sigma 2)
  • \SharpEvtMute.exe corpus 2 (sigma 2)
  • \SharpImpersonation.exe corpus 2 (sigma 2)
  • \SharpLDAPmonitor.exe corpus 2 (sigma 2)
  • \SharpLdapWhoami.exe corpus 2 (sigma 2)
  • \SharpUp.exe corpus 2 (sigma 2)
  • \SharpView.exe corpus 2 (sigma 2)
  • \SpoolSample.exe
  • \Stracciatella.exe corpus 2 (sigma 2)
  • \SysmonEOP.exe corpus 2 (sigma 2)
  • \TruffleSnout.exe corpus 2 (sigma 2)
  • \atexec_windows.exe corpus 2 (sigma 2)
  • \crackmapexec.exe corpus 2 (sigma 2)
  • \dcomexec_windows.exe corpus 2 (sigma 2)
  • \dpapi_windows.exe corpus 2 (sigma 2)
  • \findDelegation_windows.exe corpus 2 (sigma 2)
  • \getPac_windows.exe corpus 2 (sigma 2)
  • \getST_windows.exe corpus 2 (sigma 2)
  • \getTGT_windows.exe corpus 2 (sigma 2)
  • \gmer.exe corpus 2 (sigma 2)
  • \hashcat.exe corpus 2 (sigma 2)
  • \htran.exe corpus 2 (sigma 2)
  • \ifmap_windows.exe corpus 2 (sigma 2)
  • \impersonate.exe
  • \mimikatz.exe
  • \mimikatz_windows.exe corpus 2 (sigma 2)
  • \netview_windows.exe corpus 2 (sigma 2)
  • \nmapAnswerMachine_windows.exe corpus 2 (sigma 2)
  • \opdump_windows.exe corpus 2 (sigma 2)
  • \psexec_windows.exe corpus 2 (sigma 2)
  • \pypykatz.exe corpus 2 (sigma 2)
  • \rdp_check_windows.exe corpus 2 (sigma 2)
  • \sambaPipe_windows.exe corpus 2 (sigma 2)
  • \smbclient_windows.exe corpus 2 (sigma 2)
  • \smbserver_windows.exe corpus 2 (sigma 2)
  • \sniff_windows.exe corpus 2 (sigma 2)
  • \sniffer_windows.exe corpus 2 (sigma 2)
  • \split_windows.exe corpus 2 (sigma 2)
  • \temp\rot.exe
  • \ticketer_windows.exe corpus 2 (sigma 2)
  • \winPEASany.exe corpus 2 (sigma 2)
  • \winPEASany_ofs.exe corpus 2 (sigma 2)
  • \winPEASx64.exe corpus 2 (sigma 2)
  • \winPEASx64_ofs.exe corpus 2 (sigma 2)
  • \winPEASx86.exe corpus 2 (sigma 2)
  • \winPEASx86_ofs.exe corpus 2 (sigma 2)
  • \xordump.exe corpus 2 (sigma 2)
SourceImagematch
  • HotPotato corpus 2 (sigma 2)
  • Juicy Potato corpus 2 (sigma 2)
  • JuicyPotato corpus 2 (sigma 2)
  • PetitPotam corpus 2 (sigma 2)
  • RottenPotato corpus 2 (sigma 2)
  • \LocalPotato corpus 2 (sigma 2)
  • \goldenPac corpus 2 (sigma 2)
  • \just_dce_ corpus 2 (sigma 2)
  • \karmaSMB corpus 2 (sigma 2)
  • \kintercept corpus 2 (sigma 2)
  • \ntlmrelayx corpus 3 (sigma 3)
  • \rpcdump corpus 2 (sigma 2)
  • \samrdump corpus 2 (sigma 2)
  • \secretsdump corpus 2 (sigma 2)
  • \smbexec corpus 2 (sigma 2)
  • \smbrelayx corpus 3 (sigma 3)
  • \wmiexec corpus 2 (sigma 2)
  • \wmipersist corpus 2 (sigma 2)