Potential SMB Relay Attack Tool Execution

Severity: critical
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects different hacktools used for relay attacks on Windows for privilege escalation

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1557.001` Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
Collection	`T1557.001` Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `1 of selection_pe`

or:
Image|contains: HotPotato
Image|contains: 'Juicy Potato'
Image|contains: JuicyPotato
Image|contains: PetitPotam
Image|contains: RottenPotato
Image|contains: '\LocalPotato'
Image|contains: '\Potato.exe'
Image|contains: '\Responder.exe'
Image|contains: '\SpoolSample.exe'
Image|contains: '\just_dce_'
Image|contains: '\ntlmrelayx'
Image|contains: '\smbrelayx'
Image|contains: '\temp\rot.exe'

Stage 2: `1 of selection_script`

or:
CommandLine|contains: ' /ntlm:NTLMhash '
CommandLine|contains: ' ntlmrelay'
CommandLine|contains: ' smbrelay'
CommandLine|contains: '.exe -t * -p '
CommandLine|contains: Invoke-PetitPotam
CommandLine|contains: Invoke-Tater
CommandLine|contains: 'cme smb '

Stage 3: `1 of selection_juicypotato_enum`

CommandLine|endswith: '}" -z'
CommandLine|contains: '.exe -c "{'

Stage 4: `not 1 of filter_hotpotatoes`

or:
Image|contains: 'HotPotatoes '
Image|contains: HotPotatoes6
Image|contains: HotPotatoes7

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	ends_with	`}" -z`
`CommandLine`	match	`/ntlm:NTLMhash` `ntlmrelay` `smbrelay` `.exe -c "{` `.exe -t * -p` `Invoke-PetitPotam` `Invoke-Tater` corpus 2 (sigma 2) `cme smb`
`Image`	match	`HotPotato` corpus 2 (sigma 2) `HotPotatoes` `HotPotatoes6` `HotPotatoes7` `Juicy Potato` corpus 2 (sigma 2) `JuicyPotato` corpus 2 (sigma 2) `PetitPotam` corpus 2 (sigma 2) `RottenPotato` corpus 2 (sigma 2) `\LocalPotato` corpus 2 (sigma 2) `\Potato.exe` `\Responder.exe` `\SpoolSample.exe` `\just_dce_` corpus 2 (sigma 2) `\ntlmrelayx` corpus 3 (sigma 3) `\smbrelayx` corpus 3 (sigma 3) `\temp\rot.exe`

Potential SMB Relay Attack Tool Execution

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: 1 of selection_pe

Stage 2: 1 of selection_script

Stage 3: 1 of selection_juicypotato_enum

Stage 4: not 1 of filter_hotpotatoes

Indicators

Stage 1: `1 of selection_pe`

Stage 2: `1 of selection_script`

Stage 3: `1 of selection_juicypotato_enum`

Stage 4: `not 1 of filter_hotpotatoes`