Detection rules › Sigma
HackTool - winPEAS Execution
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1046 Network Service Discovery, T1082 System Information Discovery, T1087 Account Discovery |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
Stages and Predicates
Stage 1: 1 of selection_img
or:
Image|endswith: '\winPEASany.exe'
Image|endswith: '\winPEASany_ofs.exe'
Image|endswith: '\winPEASx64.exe'
Image|endswith: '\winPEASx64_ofs.exe'
Image|endswith: '\winPEASx86.exe'
Image|endswith: '\winPEASx86_ofs.exe'
OriginalFileName: winPEAS.exe
Stage 2: 1 of selection_cli_option
or:
CommandLine|contains: ' applicationsinfo'
CommandLine|contains: ' browserinfo'
CommandLine|contains: ' eventsinfo'
CommandLine|contains: ' fileanalysis'
CommandLine|contains: ' filesinfo'
CommandLine|contains: ' processinfo'
CommandLine|contains: ' servicesinfo'
CommandLine|contains: ' windowscreds'
Stage 3: 1 of selection_cli_dl
CommandLine|contains: 'https://github.com/carlospolop/PEASS-ng/releases/latest/download/'
Stage 4: 1 of selection_cli_specific
or:
CommandLine|endswith: ' -linpeas'
ParentCommandLine|endswith: ' -linpeas'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | ends_with |
|
CommandLine | match |
|
Image | ends_with |
|
OriginalFileName | eq |
|
ParentCommandLine | ends_with |
|