AD_exploitation_cheat_sheet
YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'AD exploitation cheat sheet' taken from the ThreatHunting-Keywords github project
rule AD_exploitation_cheat_sheet
{
meta:
description = "Detection patterns for the tool 'AD exploitation cheat sheet' taken from the ThreatHunting-Keywords github project"
author = "@mthcht"
reference = "https://github.com/mthcht/ThreatHunting-Keywords"
tool = "AD exploitation cheat sheet"
rule_category = "offensive_tool_keyword"
strings:
$string1 = /\s\/user\:.{0,1000}\s\/domain\:.{0,1000}\s\/aes256\:.{0,1000}\s\/run\:powershell\.exe/ nocase ascii wide
$string2 = /\s\/user\:.{0,1000}\s\/domain\:.{0,1000}\s\/ntlm\:.{0,1000}\s\/run\:powershell\.exe/ nocase ascii wide
$string3 = /\s\/user\:.{0,1000}\s\/domain\:.{0,1000}\s\/sid\:S\-1\-5\-21\-.{0,1000}\s\/krbtgt\:.{0,1000}\s\/id\:.{0,1000}\s\/groups\:.{0,1000}\s\/startoffset\:0\s\/endin\:600\s\/renewmax\:10080\s\/ptt/ nocase ascii wide
$string4 = /\s\-FakeDC\s.{0,1000}\s\-SamAccountName\s.{0,1000}\s\-Username\s/ nocase ascii wide
$string5 = /\s\-Identity\s.{0,1000}\s\-Set\s\@\{serviceprincipalname\=\'.{0,1000}\'\}/ nocase ascii wide
$string6 = /\s\-Identity\s.{0,1000}\s\-XOR\s\@\{useraccountcontrol\=4194304/ nocase ascii wide
$string7 = /\slsass\.dmp/ nocase ascii wide
$string8 = /\s\-\-no\-http\-server\s\-smb2support\s\-t\s.{0,1000}\s\-c\s/ nocase ascii wide
$string9 = " server -p 80 --reverse --socks5"
$string10 = /\.\/chisel\s/
$string11 = /\.exe\sasktgt\s\/user\:.{0,1000}\s\/aes256\:.{0,1000}\s\/opsec\s\/ptt/ nocase ascii wide
$string12 = /\.exe\sasktgt\s\/user\:.{0,1000}\s\/rc4\:.{0,1000}\s\/createnetonly\:.{0,1000}cmd\.exe/ nocase ascii wide
$string13 = /\.exe\sasktgt\s\/user\:.{0,1000}\s\/rc4\:.{0,1000}\s\/ptt/ nocase ascii wide
$string14 = /\.exe\sclient\s.{0,1000}\:.{0,1000}\sR\:socks/ nocase ascii wide
$string15 = /\.exe\sdump\s\/luid\:0x5379f2\s\/nowrap/ nocase ascii wide
$string16 = /\.exe\smonitor\s\/interval\:5\s\/nowrap/ nocase ascii wide
$string17 = /\.exe\sptt\s\/ticket\:/ nocase ascii wide
$string18 = /\.exe\ss4u\s\/ticket\:.{0,1000}\s\/impersonateuser\:.{0,1000}\s\/msdsspn\:.{0,1000}\s\/ptt/ nocase ascii wide
$string19 = /\.exe\ss4u\s\/user\:.{0,1000}\s\/impersonateuser\:.{0,1000}\s\/msdsspn\:.{0,1000}\s\/altservice\:ldap\s\/ptt\s\/rc4/ nocase ascii wide
$string20 = /\.exe\striage/ nocase ascii wide
$string21 = /\.xp_dirtree\s.{0,1000}\\/ nocase ascii wide
$string22 = /\/rockyou\.txt/
$string23 = /10k\-worst\-pass\.txt/ nocase ascii wide
$string24 = "Add-RemoteRegBackdoor" nocase ascii wide
$string25 = /Assembly\.GetType\(\'System\.Management\.Automation\.AmsiUtils\'\)\.GetField\(\'amsiInitFailed\'.{0,1000}\'NonPublic.{0,1000}Static\'\)\.SetValue\(\$null.{0,1000}\$true\)/ nocase ascii wide
$string26 = /chisel\.exe\s/ nocase ascii wide
$string27 = /copy\s\\.{0,1000}\\HarddiskVolumeShadowCopy1\\windows\\system32\\config\\sam\sC\:\\/ nocase ascii wide
$string28 = /copy\s\\.{0,1000}\\HarddiskVolumeShadowCopy1\\windows\\system32\\config\\system\sC\:\\/ nocase ascii wide
$string29 = /echo\s\-n\s\'cmd\s\/c\sstart\srundll32\s.{0,1000}\.dll.{0,1000}\s\|\sbase64/ nocase ascii wide
$string30 = "Find-InterestingDomainAcl" nocase ascii wide
$string31 = "Find-LocalAdminAccess" nocase ascii wide
$string32 = "Get-ASREPHash" nocase ascii wide
$string33 = /Get\-DomainComputer\s\-TrustedToAuth\s\|\sselect\sname/ nocase ascii wide
$string34 = "Get-DomainForeignGroupMember" nocase ascii wide
$string35 = /Get\-DomainUser\s\-TrustedToAuth\s\|\sselect\suserprincipalname/ nocase ascii wide
$string36 = /Get\-ItemProperty\s\-Path\sHKLM\:\\Software\\TightVNC\\Server\s\-Name\s.{0,1000}Password.{0,1000}\s\|\sselect\s\-ExpandProperty\sPassword/ nocase ascii wide
$string37 = /Get\-ItemProperty\s\-Path\sHKLM\:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\s\-Name\s.{0,1000}RunAsPPL/ nocase ascii wide
$string38 = "Get-RemoteCachedCredential" nocase ascii wide
$string39 = "Get-RemoteLocalAccountHash" nocase ascii wide
$string40 = "Get-RemoteMachineAccountHash" nocase ascii wide
$string41 = "Get-SqlServerLinkCrawl" nocase ascii wide
$string42 = "impacket-wmiexec"
$string43 = /incognito.{0,1000}\slist_tokens\s\-u/ nocase ascii wide
$string44 = /incognito\.exe/ nocase ascii wide
$string45 = "Invoke-AllChecks" nocase ascii wide
$string46 = "Invoke-ServiceAbuse" nocase ascii wide
$string47 = "Invoke-SQLAudit" nocase ascii wide
$string48 = /Invoke\-SQLOSCmd\s\-Instance\s.{0,1000}\s\-Command\s/ nocase ascii wide
$string49 = "Invoke-TokenManipulation" nocase ascii wide
$string50 = /lsass\.dmp/ nocase ascii wide
$string51 = /MS\-RPRN\.exe\s/ nocase ascii wide
$string52 = /mssqlsvc\.kirbi/ nocase ascii wide
$string53 = "ntlmrelayx --" nocase ascii wide
$string54 = /procdump\.exe.{0,1000}lsass/ nocase ascii wide
$string55 = /pwd.{0,1000}\/.{0,1000}\/rules\/best64\.rule/ nocase ascii wide
$string56 = "Set-DCShadowPermissions" nocase ascii wide
$string57 = "Set-DomainObject" nocase ascii wide
$string58 = /sET\-ItEM\s\(\s\'V\'\+\'aR\'\s\+\s\s\'IA\'\s\+\s\'blE\:1q2\'\s\s\+\s\'uZx\'/ nocase ascii wide
$string59 = "SharpBypassUAC" nocase ascii wide
$string60 = /tgsrepcrack\./ nocase ascii wide
$string61 = /token.{0,1000}\s\-CreateProcess\s.{0,1000}\s\-ProcessId\s/ nocase ascii wide
$string62 = /token.{0,1000}\s\-ImpersonateUser\s\-Username\s/ nocase ascii wide
$string63 = "use incognito" nocase ascii wide
$string64 = /wmic\sshadowcopy\scall\screate\sVolume\=\'C\:\\\'/ nocase ascii wide
$string65 = "Write-ServiceBinary" nocase ascii wide
condition:
any of them
}