rule_linWinPwn_offensive_tool_keyword

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'linWinPwn' taken from the ThreatHunting-Keywords github project
rule rule_linWinPwn_offensive_tool_keyword
{
    meta:
        description = "Detection patterns for the tool 'linWinPwn' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "linWinPwn"
        rule_category = "offensive_tool_keyword"

    strings:
                        $string1_linWinPwn_offensive_tool_keyword = " aad3b435b51404eeaad3b435b51404ee"
                        $string2_linWinPwn_offensive_tool_keyword = " --asreproast "
                        $string3_linWinPwn_offensive_tool_keyword = /\scoerce\s.{0,1000}\s\-\-dc\-ip\s/
                        $string4_linWinPwn_offensive_tool_keyword = /\s\-\-dc\s.{0,1000}\s\-m\scustom\s\-\-filter\s.{0,1000}objectCategory/
                        $string5_linWinPwn_offensive_tool_keyword = /\s\-dc\-ip\s.{0,1000}\s\-dump\s/
                        $string6_linWinPwn_offensive_tool_keyword = /\s\-\-dc\-ip\s.{0,1000}\s\-\-vuln\s\-\-enabled/
                        $string7_linWinPwn_offensive_tool_keyword = /\s\-dc\-ip\s.{0,1000}SAMDump/
                        $string8_linWinPwn_offensive_tool_keyword = " --force-kerb "
                        $string9_linWinPwn_offensive_tool_keyword = /\s\-\-format\=krb5asrep.{0,1000}\s\-\-wordlist\=/
                        $string10_linWinPwn_offensive_tool_keyword = " -g -n --kerberoast"
                        $string11_linWinPwn_offensive_tool_keyword = " --impersonate Administrator -shell "
                        $string12_linWinPwn_offensive_tool_keyword = /\s\-ip\s.{0,1000}\s\-smb2support\s.{0,1000}lwpshare.{0,1000}\s/
                        $string13_linWinPwn_offensive_tool_keyword = /\sldap\s.{0,1000}\s\-\-gmsa\s.{0,1000}dump/
                        $string14_linWinPwn_offensive_tool_keyword = " linWinPwn"
                        $string15_linWinPwn_offensive_tool_keyword = " -M dfscoerce "
                        $string16_linWinPwn_offensive_tool_keyword = " -M handlekatz "
                        $string17_linWinPwn_offensive_tool_keyword = " -M keepass_discover "
                        $string18_linWinPwn_offensive_tool_keyword = " -M laps --kdcHost "
                        $string19_linWinPwn_offensive_tool_keyword = " -M ldap-checker "
                        $string20_linWinPwn_offensive_tool_keyword = " -M lsassy "
                        $string21_linWinPwn_offensive_tool_keyword = " -M MAQ --kdcHost "
                        $string22_linWinPwn_offensive_tool_keyword = /\s\-M\smasky\s.{0,1000}CA\=/
                        $string23_linWinPwn_offensive_tool_keyword = " -M ms17-010 "
                        $string24_linWinPwn_offensive_tool_keyword = " -M mssql_priv "
                        $string25_linWinPwn_offensive_tool_keyword = " -M nanodump "
                        $string26_linWinPwn_offensive_tool_keyword = " -M petitpotam "
                        $string27_linWinPwn_offensive_tool_keyword = " -M printnightmare "
                        $string28_linWinPwn_offensive_tool_keyword = " -m privileged-users --full "
                        $string29_linWinPwn_offensive_tool_keyword = " -M procdump "
                        $string30_linWinPwn_offensive_tool_keyword = " -M runasppl "
                        $string31_linWinPwn_offensive_tool_keyword = " -M shadowcoerce "
                        $string32_linWinPwn_offensive_tool_keyword = " -M spider_plus "
                        $string33_linWinPwn_offensive_tool_keyword = " -M teams_localdb "
                        $string34_linWinPwn_offensive_tool_keyword = " -M zerologon "
                        $string35_linWinPwn_offensive_tool_keyword = " -no-pass -just-dc-user "
                        $string36_linWinPwn_offensive_tool_keyword = /\s\-no\-preauth\s.{0,1000}\s\-dc\-ip\s/
                        $string37_linWinPwn_offensive_tool_keyword = " --only-abuse --dc-host "
                        $string38_linWinPwn_offensive_tool_keyword = /\s\-\-password\-not\-required\s\-\-kdcHost\s.{0,1000}cme/
                        $string39_linWinPwn_offensive_tool_keyword = /\s\-pfx\s.{0,1000}\.pfx\s\-dc\-ip\s/
                        $string40_linWinPwn_offensive_tool_keyword = " -request -dc-ip "
                        $string41_linWinPwn_offensive_tool_keyword = /\s\-\-rid\-brute\s2\>\&1\s.{0,1000}\.txt/
                        $string42_linWinPwn_offensive_tool_keyword = " -save-old -dc-ip "
                        $string43_linWinPwn_offensive_tool_keyword = /\sscan\s.{0,1000}\s\-\-dc\-ip\s/
                        $string44_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,1000}\s\-\-dpapi\s.{0,1000}password/
                        $string45_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,1000}\s\-\-gen\-relay\-list\s.{0,1000}\.txt/
                        $string46_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,1000}\s\-\-lsa\s\-\-log\s/
                        $string47_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,1000}\s\-M\smsol\s/
                        $string48_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,1000}\s\-M\sntlmv1\s/
                        $string49_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,1000}\s\-\-ntds\s\-\-log\s/
                        $string50_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,1000}\s\-\-sam\s\-\-log\s/
                        $string51_linWinPwn_offensive_tool_keyword = /\suserenum\s.{0,1000}\s\-\-dc\s/
                        $string52_linWinPwn_offensive_tool_keyword = " -vulnerable -stdout -hide-admins"
                        $string53_linWinPwn_offensive_tool_keyword = /\$attacker_IPlist/
                        $string54_linWinPwn_offensive_tool_keyword = /\/asreproast_hashes_.{0,1000}\.txt/
                        $string55_linWinPwn_offensive_tool_keyword = /\/cme_adcs_output_.{0,1000}\.txt/
                        $string56_linWinPwn_offensive_tool_keyword = "/cme_shares_output_"
                        $string57_linWinPwn_offensive_tool_keyword = "/cme_spooler_output_"
                        $string58_linWinPwn_offensive_tool_keyword = /\/coercer_output_.{0,1000}\.txt/
                        $string59_linWinPwn_offensive_tool_keyword = /\/Credentials\/.{0,1000}\.ccache/
                        $string60_linWinPwn_offensive_tool_keyword = /\/Credentials\/firefox_.{0,1000}\.txt/
                        $string61_linWinPwn_offensive_tool_keyword = /\/Credentials\/msol_.{0,1000}\.txt/
                        $string62_linWinPwn_offensive_tool_keyword = /\/dcsync_.{0,1000}\.txt/
                        $string63_linWinPwn_offensive_tool_keyword = /\/DomainRecon\/.{0,1000}\.txt/
                        $string64_linWinPwn_offensive_tool_keyword = /\/gMSA_dump_.{0,1000}\.txt/
                        $string65_linWinPwn_offensive_tool_keyword = /\/keepass_discover_.{0,1000}\.txt/
                        $string66_linWinPwn_offensive_tool_keyword = /\/kerberoast_hashes_.{0,1000}\.txt/
                        $string67_linWinPwn_offensive_tool_keyword = /\/laps_dump_.{0,1000}\.txt/
                        $string68_linWinPwn_offensive_tool_keyword = "/ldeepDump"
                        $string69_linWinPwn_offensive_tool_keyword = "/linWinPwn"
                        $string70_linWinPwn_offensive_tool_keyword = /\/lsa_dump_.{0,1000}\.txt/
                        $string71_linWinPwn_offensive_tool_keyword = /\/manspider_output.{0,1000}\.txt/
                        $string72_linWinPwn_offensive_tool_keyword = "/manspiderDump"
                        $string73_linWinPwn_offensive_tool_keyword = /\/nmap_smb_scan_all_.{0,1000}\.txt/
                        $string74_linWinPwn_offensive_tool_keyword = /\/ntds_dump_.{0,1000}\.txt/
                        $string75_linWinPwn_offensive_tool_keyword = "/opt/lwp-scripts"
                        $string76_linWinPwn_offensive_tool_keyword = "/opt/lwp-wordlists"
                        $string77_linWinPwn_offensive_tool_keyword = /\/rockyou\.txt/
                        $string78_linWinPwn_offensive_tool_keyword = /\/sam_dump_.{0,1000}\.txt/
                        $string79_linWinPwn_offensive_tool_keyword = /\/Scans\/servers_all_smb.{0,1000}\.txt/
                        $string80_linWinPwn_offensive_tool_keyword = /\/secretsdump_.{0,1000}\.txt/
                        $string81_linWinPwn_offensive_tool_keyword = "/smbmapDump"
                        $string82_linWinPwn_offensive_tool_keyword = /\/windapsearch_.{0,1000}\.txt/
                        $string83_linWinPwn_offensive_tool_keyword = "asrep_attack"
                        $string84_linWinPwn_offensive_tool_keyword = "asreprc4_attack"
                        $string85_linWinPwn_offensive_tool_keyword = "asreproast_john_results_"
                        $string86_linWinPwn_offensive_tool_keyword = /asreproast_output_.{0,1000}\.txt/
                        $string87_linWinPwn_offensive_tool_keyword = "bhd_enum_dconly"
                        $string88_linWinPwn_offensive_tool_keyword = /bloodhound_output.{0,1000}\/dev\/null/
                        $string89_linWinPwn_offensive_tool_keyword = /bloodhound_output_.{0,1000}\.txt/
                        $string90_linWinPwn_offensive_tool_keyword = "bloodhound_output_dconly_"
                        $string91_linWinPwn_offensive_tool_keyword = /certi\.py_vulntemplates_output/
                        $string92_linWinPwn_offensive_tool_keyword = "certi_py_enum"
                        $string93_linWinPwn_offensive_tool_keyword = "certipy_enum"
                        $string94_linWinPwn_offensive_tool_keyword = "certsync_ntds_dump"
                        $string95_linWinPwn_offensive_tool_keyword = /cirt\-default\-usernames\.txt/
                        $string96_linWinPwn_offensive_tool_keyword = /cme_bloodhound_output_.{0,1000}\.txt/
                        $string97_linWinPwn_offensive_tool_keyword = /cme_dfscoerce_output_.{0,1000}\.txt/
                        $string98_linWinPwn_offensive_tool_keyword = "cme_get-desc-users_pass_output_"
                        $string99_linWinPwn_offensive_tool_keyword = "cme_get-desc-users_pass_results"
                        $string100_linWinPwn_offensive_tool_keyword = /cme_gpp_output_.{0,1000}\.txt/
                        $string101_linWinPwn_offensive_tool_keyword = "cme_ldap-checker_output_"
                        $string102_linWinPwn_offensive_tool_keyword = "cme_MachineAccountQuota_output_"
                        $string103_linWinPwn_offensive_tool_keyword = "cme_ms17-010_output_"
                        $string104_linWinPwn_offensive_tool_keyword = /cme_mssql_priv_output_.{0,1000}\.txt/
                        $string105_linWinPwn_offensive_tool_keyword = "cme_ntlmv1_output_"
                        $string106_linWinPwn_offensive_tool_keyword = /cme_passpol_output_.{0,1000}\.txt/
                        $string107_linWinPwn_offensive_tool_keyword = /cme_petitpotam_output_.{0,1000}\.txt/
                        $string108_linWinPwn_offensive_tool_keyword = /cme_printnightmare_output_.{0,1000}\.txt/
                        $string109_linWinPwn_offensive_tool_keyword = /cme_runasppl_output_.{0,1000}\.txt/
                        $string110_linWinPwn_offensive_tool_keyword = /cme_shadowcoerce_output_.{0,1000}\.txt/
                        $string111_linWinPwn_offensive_tool_keyword = "cme_smb_enum"
                        $string112_linWinPwn_offensive_tool_keyword = /cme_smbsigning_output_.{0,1000}\.txt/
                        $string113_linWinPwn_offensive_tool_keyword = /cme_subnets_output_.{0,1000}\.txt/
                        $string114_linWinPwn_offensive_tool_keyword = "cme_trusted-for-delegation_output_"
                        $string115_linWinPwn_offensive_tool_keyword = /cme_users_auth_ldap_.{0,1000}\.txt/
                        $string116_linWinPwn_offensive_tool_keyword = /cme_users_auth_smb_.{0,1000}\.txt/
                        $string117_linWinPwn_offensive_tool_keyword = /cme_users_nullsess_smb_.{0,1000}\.txt/
                        $string118_linWinPwn_offensive_tool_keyword = /cme_webdav_output_.{0,1000}\.txt/
                        $string119_linWinPwn_offensive_tool_keyword = /cme_zerologon_output_.{0,1000}\.txt/
                        $string120_linWinPwn_offensive_tool_keyword = "coercer_check"
                        $string121_linWinPwn_offensive_tool_keyword = /Credentials.{0,1000}hekatomb_.{0,1000}\.txt/
                        $string122_linWinPwn_offensive_tool_keyword = "Credentials/certsync_"
                        $string123_linWinPwn_offensive_tool_keyword = "Credentials/SAMDump"
                        $string124_linWinPwn_offensive_tool_keyword = "deleg_enum_imp"
                        $string125_linWinPwn_offensive_tool_keyword = "dfscoerce_check"
                        $string126_linWinPwn_offensive_tool_keyword = /DomainRecon.{0,1000}ridbrute/
                        $string127_linWinPwn_offensive_tool_keyword = "DomainRecon/ADCS"
                        $string128_linWinPwn_offensive_tool_keyword = "DomainRecon/BloodHound"
                        $string129_linWinPwn_offensive_tool_keyword = "DomainRecon/SilentHound"
                        $string130_linWinPwn_offensive_tool_keyword = "donpapi_dump"
                        $string131_linWinPwn_offensive_tool_keyword = "dpapi_dump"
                        $string132_linWinPwn_offensive_tool_keyword = /dpapi_dump_.{0,1000}\.txt/
                        $string133_linWinPwn_offensive_tool_keyword = /enum4linux_.{0,1000}\.txt/
                        $string134_linWinPwn_offensive_tool_keyword = "finduncshar_scan"
                        $string135_linWinPwn_offensive_tool_keyword = "gmsa_dump"
                        $string136_linWinPwn_offensive_tool_keyword = "handlekatz_dump"
                        $string137_linWinPwn_offensive_tool_keyword = "hekatomb_dump"
                        $string138_linWinPwn_offensive_tool_keyword = "impacket_findDelegation"
                        $string139_linWinPwn_offensive_tool_keyword = "impacket_rpcdump_output_"
                        $string140_linWinPwn_offensive_tool_keyword = "john_crack_asrep"
                        $string141_linWinPwn_offensive_tool_keyword = "john_crack_kerberoast"
                        $string142_linWinPwn_offensive_tool_keyword = "juicycreds_dump"
                        $string143_linWinPwn_offensive_tool_keyword = "-k -no-pass -p '' --auth-method kerberos"
                        $string144_linWinPwn_offensive_tool_keyword = "kerberoast_attack"
                        $string145_linWinPwn_offensive_tool_keyword = "kerberoast_blind_output_"
                        $string146_linWinPwn_offensive_tool_keyword = "kerberoast_john_results_"
                        $string147_linWinPwn_offensive_tool_keyword = "kerbrute_enum"
                        $string148_linWinPwn_offensive_tool_keyword = "kerbrute_pass_output_"
                        $string149_linWinPwn_offensive_tool_keyword = "kerbrute_user_output_"
                        $string150_linWinPwn_offensive_tool_keyword = "kerbrute_userpass_wordlist_"
                        $string151_linWinPwn_offensive_tool_keyword = "laps_dump"
                        $string152_linWinPwn_offensive_tool_keyword = "LDAPDomainDump"
                        $string153_linWinPwn_offensive_tool_keyword = "ldeep_enum"
                        $string154_linWinPwn_offensive_tool_keyword = "linWinPwn-"
                        $string155_linWinPwn_offensive_tool_keyword = /linWinPwn\./
                        $string156_linWinPwn_offensive_tool_keyword = "lsass_dump_"
                        $string157_linWinPwn_offensive_tool_keyword = "lsass_dump_lsassy_"
                        $string158_linWinPwn_offensive_tool_keyword = "lsassy_dump"
                        $string159_linWinPwn_offensive_tool_keyword = "manspider_scan"
                        $string160_linWinPwn_offensive_tool_keyword = "masky_dump"
                        $string161_linWinPwn_offensive_tool_keyword = "ms14-068_check"
                        $string162_linWinPwn_offensive_tool_keyword = "ms17-010_check"
                        $string163_linWinPwn_offensive_tool_keyword = "msol_dump"
                        $string164_linWinPwn_offensive_tool_keyword = "nanodump_dump"
                        $string165_linWinPwn_offensive_tool_keyword = /nmap_smb_scan_custom_.{0,1000}\.txt/
                        $string166_linWinPwn_offensive_tool_keyword = "ntlmv1_check"
                        $string167_linWinPwn_offensive_tool_keyword = /Passwords\/Leaked\-Databases.{0,1000}\.txt/
                        $string168_linWinPwn_offensive_tool_keyword = "petitpotam_check"
                        $string169_linWinPwn_offensive_tool_keyword = "printnightmare_check"
                        $string170_linWinPwn_offensive_tool_keyword = "procdump_dump"
                        $string171_linWinPwn_offensive_tool_keyword = "pwd_dump "
                        $string172_linWinPwn_offensive_tool_keyword = "ridbrute_attack"
                        $string173_linWinPwn_offensive_tool_keyword = /rpc\:\/\/.{0,1000}\s\-rpc\-mode\sICPR\s\-icpr\-ca\-name\s/
                        $string174_linWinPwn_offensive_tool_keyword = "rpcdump_check"
                        $string175_linWinPwn_offensive_tool_keyword = "runasppl_check"
                        $string176_linWinPwn_offensive_tool_keyword = "secrets_dump"
                        $string177_linWinPwn_offensive_tool_keyword = "secrets_dump_dcsync"
                        $string178_linWinPwn_offensive_tool_keyword = "shadowcoerce_check"
                        $string179_linWinPwn_offensive_tool_keyword = "Shares/cme_spider_plus"
                        $string180_linWinPwn_offensive_tool_keyword = /Shares\/finduncshar_.{0,1000}\.txt/
                        $string181_linWinPwn_offensive_tool_keyword = "silenthound_enum"
                        $string182_linWinPwn_offensive_tool_keyword = /silenthound_output_.{0,1000}\.txt/
                        $string183_linWinPwn_offensive_tool_keyword = "smbmapDump"
                        $string184_linWinPwn_offensive_tool_keyword = "smbsigning_check"
                        $string185_linWinPwn_offensive_tool_keyword = "spooler_check"
                        $string186_linWinPwn_offensive_tool_keyword = "targetedkerberoast_attack"
                        $string187_linWinPwn_offensive_tool_keyword = /targetedkerberoast_hashes_.{0,1000}\.txt/
                        $string188_linWinPwn_offensive_tool_keyword = /targetedkerberoast_output_.{0,1000}\.txt/
                        $string189_linWinPwn_offensive_tool_keyword = "--trusted-for-delegation --kdcHost "
                        $string190_linWinPwn_offensive_tool_keyword = /user_eq_pass_valid_cme_.{0,1000}\.txt/
                        $string191_linWinPwn_offensive_tool_keyword = "userpass_cme_check"
                        $string192_linWinPwn_offensive_tool_keyword = "userpass_kerbrute_check"
                        $string193_linWinPwn_offensive_tool_keyword = "users_list_cme_ldap_nullsess_"
                        $string194_linWinPwn_offensive_tool_keyword = "users_list_kerbrute_"
                        $string195_linWinPwn_offensive_tool_keyword = "users_list_ridbrute_"
                        $string196_linWinPwn_offensive_tool_keyword = "veeam_dump"
                        $string197_linWinPwn_offensive_tool_keyword = "Vulnerabilities/RPCDump"
                        $string198_linWinPwn_offensive_tool_keyword = "windapsearch_enum"
                        $string199_linWinPwn_offensive_tool_keyword = /xato\-net\-10\-million\-usernames\.txt/
                        $string200_linWinPwn_offensive_tool_keyword = "zerologon_check"

    condition:
        any of them
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

cadb94be-fdb0-4b5e-bfdd-4bddf0accf10
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
