rule_AD_exploitation_cheat_sheet_offensive_tool_keyword

YARA detection rule by @mthcht · NOASSERTION

Detection patterns for the tool 'AD exploitation cheat sheet' taken from the ThreatHunting-Keywords github project

rule rule_AD_exploitation_cheat_sheet_offensive_tool_keyword
{
    meta:
        description = "Detection patterns for the tool 'AD exploitation cheat sheet' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "AD exploitation cheat sheet"
        rule_category = "offensive_tool_keyword"

    strings:
                        $string1_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\/user\:.{0,1000}\s\/domain\:.{0,1000}\s\/aes256\:.{0,1000}\s\/run\:powershell\.exe/ nocase ascii wide
                        $string2_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\/user\:.{0,1000}\s\/domain\:.{0,1000}\s\/ntlm\:.{0,1000}\s\/run\:powershell\.exe/ nocase ascii wide
                        $string3_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\/user\:.{0,1000}\s\/domain\:.{0,1000}\s\/sid\:S\-1\-5\-21\-.{0,1000}\s\/krbtgt\:.{0,1000}\s\/id\:.{0,1000}\s\/groups\:.{0,1000}\s\/startoffset\:0\s\/endin\:600\s\/renewmax\:10080\s\/ptt/ nocase ascii wide
                        $string4_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\-FakeDC\s.{0,1000}\s\-SamAccountName\s.{0,1000}\s\-Username\s/ nocase ascii wide
                        $string5_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\-Identity\s.{0,1000}\s\-Set\s\@\{serviceprincipalname\=\'.{0,1000}\'\}/ nocase ascii wide
                        $string6_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\-Identity\s.{0,1000}\s\-XOR\s\@\{useraccountcontrol\=4194304/ nocase ascii wide
                        $string7_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\slsass\.dmp/ nocase ascii wide
                        $string8_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\-\-no\-http\-server\s\-smb2support\s\-t\s.{0,1000}\s\-c\s/ nocase ascii wide
                        $string9_AD_exploitation_cheat_sheet_offensive_tool_keyword = " server -p 80 --reverse --socks5"
                        $string10_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.\/chisel\s/
                        $string11_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sasktgt\s\/user\:.{0,1000}\s\/aes256\:.{0,1000}\s\/opsec\s\/ptt/ nocase ascii wide
                        $string12_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sasktgt\s\/user\:.{0,1000}\s\/rc4\:.{0,1000}\s\/createnetonly\:.{0,1000}cmd\.exe/ nocase ascii wide
                        $string13_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sasktgt\s\/user\:.{0,1000}\s\/rc4\:.{0,1000}\s\/ptt/ nocase ascii wide
                        $string14_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sclient\s.{0,1000}\:.{0,1000}\sR\:socks/ nocase ascii wide
                        $string15_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sdump\s\/luid\:0x5379f2\s\/nowrap/ nocase ascii wide
                        $string16_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\smonitor\s\/interval\:5\s\/nowrap/ nocase ascii wide
                        $string17_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sptt\s\/ticket\:/ nocase ascii wide
                        $string18_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\ss4u\s\/ticket\:.{0,1000}\s\/impersonateuser\:.{0,1000}\s\/msdsspn\:.{0,1000}\s\/ptt/ nocase ascii wide
                        $string19_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\ss4u\s\/user\:.{0,1000}\s\/impersonateuser\:.{0,1000}\s\/msdsspn\:.{0,1000}\s\/altservice\:ldap\s\/ptt\s\/rc4/ nocase ascii wide
                        $string20_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\striage/ nocase ascii wide
                        $string21_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.xp_dirtree\s.{0,1000}\\/ nocase ascii wide
                        $string22_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\/rockyou\.txt/
                        $string23_AD_exploitation_cheat_sheet_offensive_tool_keyword = /10k\-worst\-pass\.txt/ nocase ascii wide
                        $string24_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Add-RemoteRegBackdoor" nocase ascii wide
                        $string25_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Assembly\.GetType\(\'System\.Management\.Automation\.AmsiUtils\'\)\.GetField\(\'amsiInitFailed\'.{0,1000}\'NonPublic.{0,1000}Static\'\)\.SetValue\(\$null.{0,1000}\$true\)/ nocase ascii wide
                        $string26_AD_exploitation_cheat_sheet_offensive_tool_keyword = /chisel\.exe\s/ nocase ascii wide
                        $string27_AD_exploitation_cheat_sheet_offensive_tool_keyword = /copy\s\\.{0,1000}\\HarddiskVolumeShadowCopy1\\windows\\system32\\config\\sam\sC\:\\/ nocase ascii wide
                        $string28_AD_exploitation_cheat_sheet_offensive_tool_keyword = /copy\s\\.{0,1000}\\HarddiskVolumeShadowCopy1\\windows\\system32\\config\\system\sC\:\\/ nocase ascii wide
                        $string29_AD_exploitation_cheat_sheet_offensive_tool_keyword = /echo\s\-n\s\'cmd\s\/c\sstart\srundll32\s.{0,1000}\.dll.{0,1000}\s\|\sbase64/ nocase ascii wide
                        $string30_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Find-InterestingDomainAcl" nocase ascii wide
                        $string31_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Find-LocalAdminAccess" nocase ascii wide
                        $string32_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-ASREPHash" nocase ascii wide
                        $string33_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Get\-DomainComputer\s\-TrustedToAuth\s\|\sselect\sname/ nocase ascii wide
                        $string34_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-DomainForeignGroupMember" nocase ascii wide
                        $string35_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Get\-DomainUser\s\-TrustedToAuth\s\|\sselect\suserprincipalname/ nocase ascii wide
                        $string36_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Get\-ItemProperty\s\-Path\sHKLM\:\\Software\\TightVNC\\Server\s\-Name\s.{0,1000}Password.{0,1000}\s\|\sselect\s\-ExpandProperty\sPassword/ nocase ascii wide
                        $string37_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Get\-ItemProperty\s\-Path\sHKLM\:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\s\-Name\s.{0,1000}RunAsPPL/ nocase ascii wide
                        $string38_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-RemoteCachedCredential" nocase ascii wide
                        $string39_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-RemoteLocalAccountHash" nocase ascii wide
                        $string40_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-RemoteMachineAccountHash" nocase ascii wide
                        $string41_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-SqlServerLinkCrawl" nocase ascii wide
                        $string42_AD_exploitation_cheat_sheet_offensive_tool_keyword = "impacket-wmiexec"
                        $string43_AD_exploitation_cheat_sheet_offensive_tool_keyword = /incognito.{0,1000}\slist_tokens\s\-u/ nocase ascii wide
                        $string44_AD_exploitation_cheat_sheet_offensive_tool_keyword = /incognito\.exe/ nocase ascii wide
                        $string45_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Invoke-AllChecks" nocase ascii wide
                        $string46_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Invoke-ServiceAbuse" nocase ascii wide
                        $string47_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Invoke-SQLAudit" nocase ascii wide
                        $string48_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Invoke\-SQLOSCmd\s\-Instance\s.{0,1000}\s\-Command\s/ nocase ascii wide
                        $string49_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Invoke-TokenManipulation" nocase ascii wide
                        $string50_AD_exploitation_cheat_sheet_offensive_tool_keyword = /lsass\.dmp/ nocase ascii wide
                        $string51_AD_exploitation_cheat_sheet_offensive_tool_keyword = /MS\-RPRN\.exe\s/ nocase ascii wide
                        $string52_AD_exploitation_cheat_sheet_offensive_tool_keyword = /mssqlsvc\.kirbi/ nocase ascii wide
                        $string53_AD_exploitation_cheat_sheet_offensive_tool_keyword = "ntlmrelayx --" nocase ascii wide
                        $string54_AD_exploitation_cheat_sheet_offensive_tool_keyword = /procdump\.exe.{0,1000}lsass/ nocase ascii wide
                        $string55_AD_exploitation_cheat_sheet_offensive_tool_keyword = /pwd.{0,1000}\/.{0,1000}\/rules\/best64\.rule/ nocase ascii wide
                        $string56_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Set-DCShadowPermissions" nocase ascii wide
                        $string57_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Set-DomainObject" nocase ascii wide
                        $string58_AD_exploitation_cheat_sheet_offensive_tool_keyword = /sET\-ItEM\s\(\s\'V\'\+\'aR\'\s\+\s\s\'IA\'\s\+\s\'blE\:1q2\'\s\s\+\s\'uZx\'/ nocase ascii wide
                        $string59_AD_exploitation_cheat_sheet_offensive_tool_keyword = "SharpBypassUAC" nocase ascii wide
                        $string60_AD_exploitation_cheat_sheet_offensive_tool_keyword = /tgsrepcrack\./ nocase ascii wide
                        $string61_AD_exploitation_cheat_sheet_offensive_tool_keyword = /token.{0,1000}\s\-CreateProcess\s.{0,1000}\s\-ProcessId\s/ nocase ascii wide
                        $string62_AD_exploitation_cheat_sheet_offensive_tool_keyword = /token.{0,1000}\s\-ImpersonateUser\s\-Username\s/ nocase ascii wide
                        $string63_AD_exploitation_cheat_sheet_offensive_tool_keyword = "use incognito" nocase ascii wide
                        $string64_AD_exploitation_cheat_sheet_offensive_tool_keyword = /wmic\sshadowcopy\scall\screate\sVolume\=\'C\:\\\'/ nocase ascii wide
                        $string65_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Write-ServiceBinary" nocase ascii wide

    condition:
        any of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c4b93e5b-41d6-4edf-aaa7-288e3a39bc02

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion