title: Impacket Tool Execution
author: Florian Roth
date: 2021/07/24
description: Detects the execution of different compiled Windows binaries of the impacket
    toolset (based on names or part of their names - could lead to false positives)
detection:
    SELECTION_1:
        EventID: 1
    SELECTION_10:
        Image: '*\smbrelayx*'
    SELECTION_11:
        Image: '*\wmiexec*'
    SELECTION_12:
        Image: '*\wmipersist*'
    SELECTION_13:
        Image: '*\atexec_windows.exe'
    SELECTION_14:
        Image: '*\dcomexec_windows.exe'
    SELECTION_15:
        Image: '*\dpapi_windows.exe'
    SELECTION_16:
        Image: '*\findDelegation_windows.exe'
    SELECTION_17:
        Image: '*\GetADUsers_windows.exe'
    SELECTION_18:
        Image: '*\GetNPUsers_windows.exe'
    SELECTION_19:
        Image: '*\getPac_windows.exe'
    SELECTION_2:
        Image: '*\goldenPac*'
    SELECTION_20:
        Image: '*\getST_windows.exe'
    SELECTION_21:
        Image: '*\getTGT_windows.exe'
    SELECTION_22:
        Image: '*\GetUserSPNs_windows.exe'
    SELECTION_23:
        Image: '*\ifmap_windows.exe'
    SELECTION_24:
        Image: '*\mimikatz_windows.exe'
    SELECTION_25:
        Image: '*\netview_windows.exe'
    SELECTION_26:
        Image: '*\nmapAnswerMachine_windows.exe'
    SELECTION_27:
        Image: '*\opdump_windows.exe'
    SELECTION_28:
        Image: '*\psexec_windows.exe'
    SELECTION_29:
        Image: '*\rdp_check_windows.exe'
    SELECTION_3:
        Image: '*\karmaSMB*'
    SELECTION_30:
        Image: '*\sambaPipe_windows.exe'
    SELECTION_31:
        Image: '*\smbclient_windows.exe'
    SELECTION_32:
        Image: '*\smbserver_windows.exe'
    SELECTION_33:
        Image: '*\sniffer_windows.exe'
    SELECTION_34:
        Image: '*\sniff_windows.exe'
    SELECTION_35:
        Image: '*\split_windows.exe'
    SELECTION_36:
        Image: '*\ticketer_windows.exe'
    SELECTION_4:
        Image: '*\kintercept*'
    SELECTION_5:
        Image: '*\ntlmrelayx*'
    SELECTION_6:
        Image: '*\rpcdump*'
    SELECTION_7:
        Image: '*\samrdump*'
    SELECTION_8:
        Image: '*\secretsdump*'
    SELECTION_9:
        Image: '*\smbexec*'
    condition: (SELECTION_1 and ((SELECTION_2 or SELECTION_3 or SELECTION_4 or SELECTION_5
        or SELECTION_6 or SELECTION_7 or SELECTION_8 or SELECTION_9 or SELECTION_10
        or SELECTION_11 or SELECTION_12) or (SELECTION_13 or SELECTION_14 or SELECTION_15
        or SELECTION_16 or SELECTION_17 or SELECTION_18 or SELECTION_19 or SELECTION_20
        or SELECTION_21 or SELECTION_22 or SELECTION_23 or SELECTION_24 or SELECTION_25
        or SELECTION_26 or SELECTION_27 or SELECTION_28 or SELECTION_29 or SELECTION_30
        or SELECTION_31 or SELECTION_32 or SELECTION_33 or SELECTION_34 or SELECTION_35
        or SELECTION_36)))
falsepositives:
- Legitimate use of the impacket tools
id: 4627c6ae-6899-46e2-aa0c-6ebcb1becd19
level: high
logsource:
    category: process_creation
    product: windows
references:
- https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries
status: experimental
tags:
- attack.execution
- attack.t1557.001
yml_filename: win_impacket_compiled_tools.yml
yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/process_creation