Detection rules › Sigma

HackTool - winPEAS Execution

Severity
high
Author
Georg Lauenstein (sure[secure])
Source
upstream

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1046 Network Service Discovery, T1082 System Information Discovery, T1087 Account Discovery

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: 1 of selection_img

or:
Image|endswith: '\winPEASany.exe'
Image|endswith: '\winPEASany_ofs.exe'
Image|endswith: '\winPEASx64.exe'
Image|endswith: '\winPEASx64_ofs.exe'
Image|endswith: '\winPEASx86.exe'
Image|endswith: '\winPEASx86_ofs.exe'
OriginalFileName: winPEAS.exe

Stage 2: 1 of selection_cli_option

or:
CommandLine|contains: ' applicationsinfo'
CommandLine|contains: ' browserinfo'
CommandLine|contains: ' eventsinfo'
CommandLine|contains: ' fileanalysis'
CommandLine|contains: ' filesinfo'
CommandLine|contains: ' processinfo'
CommandLine|contains: ' servicesinfo'
CommandLine|contains: ' windowscreds'

Stage 3: 1 of selection_cli_dl

CommandLine|contains: 'https://github.com/carlospolop/PEASS-ng/releases/latest/download/'

Stage 4: 1 of selection_cli_specific

or:
CommandLine|endswith: ' -linpeas'
ParentCommandLine|endswith: ' -linpeas'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineends_with
  • -linpeas
CommandLinematch
  • applicationsinfo
  • browserinfo
  • eventsinfo
  • fileanalysis
  • filesinfo
  • processinfo
  • servicesinfo
  • windowscreds
  • https://github.com/carlospolop/PEASS-ng/releases/latest/download/
Imageends_with
  • \winPEASany.exe corpus 2 (sigma 2)
  • \winPEASany_ofs.exe corpus 2 (sigma 2)
  • \winPEASx64.exe corpus 2 (sigma 2)
  • \winPEASx64_ofs.exe corpus 2 (sigma 2)
  • \winPEASx86.exe corpus 2 (sigma 2)
  • \winPEASx86_ofs.exe corpus 2 (sigma 2)
OriginalFileNameeq
  • winPEAS.exe
ParentCommandLineends_with
  • -linpeas