52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
title: PsExec/PAExec Flags
|
|
author: Florian Roth
|
|
date: 2021/05/22
|
|
description: Detects suspicious flags used by PsExec and PAExec but no usual program
|
|
name in command line
|
|
detection:
|
|
SELECTION_1:
|
|
EventID: 1
|
|
SELECTION_10:
|
|
CommandLine: '*paexec*'
|
|
SELECTION_11:
|
|
CommandLine: '*PsExec*'
|
|
SELECTION_2:
|
|
EventID: 1
|
|
SELECTION_3:
|
|
CommandLine: '*\\127.0.0.1*'
|
|
SELECTION_4:
|
|
CommandLine: '* -s *'
|
|
SELECTION_5:
|
|
CommandLine: '*cmd.exe*'
|
|
SELECTION_6:
|
|
CommandLine: '* /accepteula *'
|
|
SELECTION_7:
|
|
CommandLine: '*cmd /c *'
|
|
SELECTION_8:
|
|
CommandLine: '* -u *'
|
|
SELECTION_9:
|
|
CommandLine: '* -p *'
|
|
condition: (SELECTION_1 and (SELECTION_2 and ((SELECTION_3 and SELECTION_4 and
|
|
SELECTION_5) or (SELECTION_6 and SELECTION_7 and SELECTION_8 and SELECTION_9)))
|
|
and not ((SELECTION_10 or SELECTION_11)))
|
|
falsepositives:
|
|
- Weird admins that rename their tools
|
|
- Software companies that bundle PsExec/PAExec with their software and rename it,
|
|
so that it is less embarrassing
|
|
id: 207b0396-3689-42d9-8399-4222658efc99
|
|
level: high
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
references:
|
|
- https://docs.microsoft.com/en-us/sysinternals/downloads/psexec
|
|
- https://www.poweradmin.com/paexec/
|
|
- https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
|
|
status: experimental
|
|
tags:
|
|
- attack.develop_capabilities
|
|
- attack.t1587.001
|
|
yml_filename: win_susp_psexex_paexec_flags.yml
|
|
yml_path: /Users/user/Documents/YamatoSecurity/sigma/rules/windows/process_creation
|
|
|