impacket

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'impacket' taken from the ThreatHunting-Keywords github project
rule impacket
{
    meta:
        description = "Detection patterns for the tool 'impacket' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "impacket"
        rule_category = "offensive_tool_keyword"

    strings:
                        $string1 = /\s\/Q\s\/C\s\>1\s\\\\127\.0\.01\\ADMIN\$\\__/ nocase ascii wide
                        $string2 = " -brute-opnums " nocase ascii wide
                        $string3 = " -brute-uuids " nocase ascii wide
                        $string4 = /\sdacledit\.py/ nocase ascii wide
                        $string5 = /\s\-dc\-ip\s.{0,1000}\s\-so\s/ nocase ascii wide
                        $string6 = /\s\-dc\-ip\s.{0,1000}\s\-computer\-pass\s/ nocase ascii wide
                        $string7 = /\s\-dc\-ip\s.{0,1000}\s\-impersonate\s/ nocase ascii wide
                        $string8 = /\s\-dc\-ip\s.{0,1000}\s\-target\-ip\s/ nocase ascii wide
                        $string9 = /\sdump\-lsass\.py/ nocase ascii wide
                        $string10 = " -force-forwardable" nocase ascii wide
                        $string11 = /\s\-hashes\s.{0,1000}\s\-spn\s.{0,1000}\s\-impersonate\s/ nocase ascii wide
                        $string12 = " impacket" nocase ascii wide
                        $string13 = " impacket/" nocase ascii wide
                        $string14 = /\s\-impersonate.{0,1000}\s\-hashes/ nocase ascii wide
                        $string15 = " -just-dc-ntlm  " nocase ascii wide
                        $string16 = " -just-dc-user " nocase ascii wide
                        $string17 = /\s\-k\s\-request\-user\s.{0,1000}\s\-dc\-ip/ nocase ascii wide
                        $string18 = " LMHASH:NTHASH" nocase ascii wide
                        $string19 = " -no-pass -usersfile " nocase ascii wide
                        $string20 = /\s\-ntds\s.{0,1000}\.dit\s.{0,1000}\-system\s/ nocase ascii wide
                        $string21 = /\s\-ntds\sntds\.dit\s\-system\sSYSTEM\s/ nocase ascii wide
                        $string22 = /\s\-nthash\s.{0,1000}\s\-domain\-sid\s/ nocase ascii wide
                        $string23 = /\sntlm\.py/ nocase ascii wide
                        $string24 = /\sntlmrelayx\.py/ nocase ascii wide
                        $string25 = " PrincipalsAllowedToDelegateToAccount " nocase ascii wide
                        $string26 = /\s\-sam\s.{0,1000}\s\-system\s.{0,1000}\s\-security\s.{0,1000}\sLOCAL\s\>\s.{0,1000}\.out/ nocase ascii wide
                        $string27 = " --shadow-credentials --shadow-target " nocase ascii wide
                        $string28 = /\s\-spn\scifs\/.{0,1000}\s\-hashes/ nocase ascii wide
                        $string29 = /\s\-system\sSYSTEM\s\-ntds\sNTDS\.dit\sLOCAL/ nocase ascii wide
                        $string30 = /\s\-system\sSYSTEM\s\-ntds\sNTDS\.dit\s\-outputfile/ nocase ascii wide
                        $string31 = /\s\-target\-domain\s.{0,1000}\s\-outputfile\s.{0,1000}\s\-no\-pass/ nocase ascii wide
                        $string32 = /\.py\s.{0,1000}\s\-k\s\-no\-pass/ nocase ascii wide
                        $string33 = /\.py\s\-use\-remoteSSMethod\s/ nocase ascii wide
                        $string34 = /\/addcomputer\.py/ nocase ascii wide
                        $string35 = /\/atexec\.py/ nocase ascii wide
                        $string36 = /\/atexec\.py/ nocase ascii wide
                        $string37 = /\/attacks\/.{0,1000}\.py/ nocase ascii wide
                        $string38 = /\/Certipy\.exe/ nocase ascii wide
                        $string39 = /\/changepasswd\.py/
                        $string40 = /\/dacledit\.py/ nocase ascii wide
                        $string41 = /\/dacledit\.py/ nocase ascii wide
                        $string42 = /\/dcomexec\.exe/ nocase ascii wide
                        $string43 = /\/dcomexec\.py/ nocase ascii wide
                        $string44 = /\/describeTicket\.py/ nocase ascii wide
                        $string45 = /\/dpapi\.py/ nocase ascii wide
                        $string46 = /\/Dump\-Lsass\.git/ nocase ascii wide
                        $string47 = /\/dump\-lsass\.py/ nocase ascii wide
                        $string48 = /\/DumpNTLMInfo\.py/ nocase ascii wide
                        $string49 = /\/esentutl\.py/ nocase ascii wide
                        $string50 = /\/exchanger\.py/ nocase ascii wide
                        $string51 = /\/exchanger\.py/ nocase ascii wide
                        $string52 = /\/findDelegation\.py/ nocase ascii wide
                        $string53 = /\/GetADComputers\.py/ nocase ascii wide
                        $string54 = /\/GetADUsers\.py/ nocase ascii wide
                        $string55 = /\/getArch\.py/ nocase ascii wide
                        $string56 = /\/Get\-GPPPassword\.py/ nocase ascii wide
                        $string57 = /\/GetLAPSPassword\.py/ nocase ascii wide
                        $string58 = /\/GetNPUsers\.exe/ nocase ascii wide
                        $string59 = /\/GetNPUsers\.py/ nocase ascii wide
                        $string60 = /\/getOSandSMBproperties\.exe/ nocase ascii wide
                        $string61 = /\/getPac\.exe/ nocase ascii wide
                        $string62 = /\/getPac\.py/ nocase ascii wide
                        $string63 = /\/getST\.py/ nocase ascii wide
                        $string64 = /\/getST2\.py/ nocase ascii wide
                        $string65 = /\/getTGT\.py/ nocase ascii wide
                        $string66 = /\/GetUserSPNs\.py/ nocase ascii wide
                        $string67 = /\/goldenPac\.py/ nocase ascii wide
                        $string68 = /\/impacket\./ nocase ascii wide
                        $string69 = /\/impacket\.git/ nocase ascii wide
                        $string70 = "/impacket/" nocase ascii wide
                        $string71 = /\/karmaSMB\.exe/ nocase ascii wide
                        $string72 = /\/karmaSMB\.py/ nocase ascii wide
                        $string73 = "/kerberos-ldap-password-hunter" nocase ascii wide
                        $string74 = /\/keylistattack\.py/ nocase ascii wide
                        $string75 = /\/kintercept\.py/ nocase ascii wide
                        $string76 = /\/krb5\/.{0,1000}\.py/ nocase ascii wide
                        $string77 = /\/ldap\.py/ nocase ascii wide
                        $string78 = /\/lookupsid\.py/ nocase ascii wide
                        $string79 = /\/lookupsid\.py/ nocase ascii wide
                        $string80 = /\/machine_role\.py/ nocase ascii wide
                        $string81 = /\/mimikatz\.py/ nocase ascii wide
                        $string82 = /\/mqtt_check\.py/ nocase ascii wide
                        $string83 = /\/mssqlclient\.py/ nocase ascii wide
                        $string84 = /\/mssqlinstance\.py/ nocase ascii wide
                        $string85 = /\/netview\.py/ nocase ascii wide
                        $string86 = /\/nmapAnswerMachine\.exe/ nocase ascii wide
                        $string87 = /\/nmapAnswerMachine\.py/ nocase ascii wide
                        $string88 = /\/ntfs\-read\.py/ nocase ascii wide
                        $string89 = /\/ntlm\.py/ nocase ascii wide
                        $string90 = /\/ntlmrelayx\.exe/ nocase ascii wide
                        $string91 = /\/ntlmrelayx\.exe/ nocase ascii wide
                        $string92 = /\/ntlmrelayx\.py/ nocase ascii wide
                        $string93 = /\/ntlmrelayx\.py/ nocase ascii wide
                        $string94 = /\/owneredit\.py/ nocase ascii wide
                        $string95 = /\/ping6\.py/ nocase ascii wide
                        $string96 = /\/psexec\.py/ nocase ascii wide
                        $string97 = /\/rbcd\.py/ nocase ascii wide
                        $string98 = /\/rdp_check\.py/ nocase ascii wide
                        $string99 = /\/registry\-read\.py/ nocase ascii wide
                        $string100 = "/releases/download/impacket_" nocase ascii wide
                        $string101 = /\/rpc\/rpcproxy\.dll\?/ nocase ascii wide
                        $string102 = /\/rpcdump\.py/ nocase ascii wide
                        $string103 = /\/rpcmap\.py/ nocase ascii wide
                        $string104 = /\/sambaPipe\.py/ nocase ascii wide
                        $string105 = /\/samrdump\.exe/ nocase ascii wide
                        $string106 = /\/samrdump\.py/ nocase ascii wide
                        $string107 = /\/secretsdump\.exe/ nocase ascii wide
                        $string108 = /\/secretsdump\.py/ nocase ascii wide
                        $string109 = /\/smb\.py/ nocase ascii wide
                        $string110 = /\/SMB_RPC\/.{0,1000}\.py/ nocase ascii wide
                        $string111 = /\/smb3\.py/ nocase ascii wide
                        $string112 = /\/smbclient\.exe/ nocase ascii wide
                        $string113 = /\/smbclient\.py/ nocase ascii wide
                        $string114 = /\/smbexec\.py/ nocase ascii wide
                        $string115 = /\/smbpasswd\.py/ nocase ascii wide
                        $string116 = /\/smbrelayx\.exe/ nocase ascii wide
                        $string117 = /\/smbrelayx\.py/ nocase ascii wide
                        $string118 = /\/smbserver\.py/ nocase ascii wide
                        $string119 = /\/sniff\.py/ nocase ascii wide
                        $string120 = /\/sniff\.py/ nocase ascii wide
                        $string121 = /\/sniffer\.exe/ nocase ascii wide
                        $string122 = /\/sniffer\.py/ nocase ascii wide
                        $string123 = /\/ticketConverter\.py/ nocase ascii wide
                        $string124 = /\/ticketer\.exe/ nocase ascii wide
                        $string125 = /\/ticketer\.py/ nocase ascii wide
                        $string126 = /\/winregistry\.py/ nocase ascii wide
                        $string127 = /\/wmiexec\.py/ nocase ascii wide
                        $string128 = /\/wmipersist\.exe/ nocase ascii wide
                        $string129 = /\/wmipersist\.py/ nocase ascii wide
                        $string130 = /\/wmiquery\.py/ nocase ascii wide
                        $string131 = /\:9090.{0,1000}\/api\/v1\.0\/relays/ nocase ascii wide
                        $string132 = /\\\$.{0,1000}\.kirbi/ nocase ascii wide
                        $string133 = /\\\\127\.0\.0\.1\\c\$/ nocase ascii wide
                        $string134 = /\\__output\s2\^\>\^\&1\s\>/ nocase ascii wide
                        $string135 = /\\__output\s2\>\&1\s\>/ nocase ascii wide
                        $string136 = /\\addcomputer\.py/ nocase ascii wide
                        $string137 = /\\atexec\.py/ nocase ascii wide
                        $string138 = /\\C\$\\__output/ nocase ascii wide
                        $string139 = /\\Certipy\.exe/ nocase ascii wide
                        $string140 = /\\changepasswd\.py/ nocase ascii wide
                        $string141 = /\\dacledit\-.{0,1000}\.bak/ nocase ascii wide
                        $string142 = /\\dacledit\.py/ nocase ascii wide
                        $string143 = /\\dacledit\.py/ nocase ascii wide
                        $string144 = /\\dcomexec\.exe/ nocase ascii wide
                        $string145 = /\\dcomexec\.py/ nocase ascii wide
                        $string146 = /\\describeTicket\.py/ nocase ascii wide
                        $string147 = /\\dpapi\.py/ nocase ascii wide
                        $string148 = /\\dump\-lsass\.py/ nocase ascii wide
                        $string149 = /\\DumpNTLMInfo\.py/ nocase ascii wide
                        $string150 = /\\esentutl\.py/ nocase ascii wide
                        $string151 = /\\exchanger\.py/ nocase ascii wide
                        $string152 = /\\findDelegation\.py/ nocase ascii wide
                        $string153 = /\\GetADComputers\.py/ nocase ascii wide
                        $string154 = /\\GetADUsers\.py/ nocase ascii wide
                        $string155 = /\\getArch\.py/ nocase ascii wide
                        $string156 = /\\Get\-GPPPassword\.py/ nocase ascii wide
                        $string157 = /\\GetLAPSPassword\.py/ nocase ascii wide
                        $string158 = /\\GetNPUsers\.exe/ nocase ascii wide
                        $string159 = /\\GetNPUsers\.py/ nocase ascii wide
                        $string160 = /\\getOSandSMBproperties\.exe/ nocase ascii wide
                        $string161 = /\\getPac\.exe/ nocase ascii wide
                        $string162 = /\\getPac\.py/ nocase ascii wide
                        $string163 = /\\getST\.py/ nocase ascii wide
                        $string164 = /\\getST2\.py/ nocase ascii wide
                        $string165 = /\\getTGT\.py/ nocase ascii wide
                        $string166 = /\\GetUserSPNs\.py/ nocase ascii wide
                        $string167 = /\\goldenPac\.py/ nocase ascii wide
                        $string168 = /\\impacket\./ nocase ascii wide
                        $string169 = /\\karmaSMB\.exe/ nocase ascii wide
                        $string170 = /\\karmaSMB\.py/ nocase ascii wide
                        $string171 = /\\keylistattack\.py/ nocase ascii wide
                        $string172 = /\\kintercept\.py/ nocase ascii wide
                        $string173 = /\\krb5\\.{0,1000}\.py/ nocase ascii wide
                        $string174 = /\\lookupsid\.py/ nocase ascii wide
                        $string175 = /\\machine_role\.py/ nocase ascii wide
                        $string176 = /\\mimikatz\.py/ nocase ascii wide
                        $string177 = /\\mqtt_check\.py/ nocase ascii wide
                        $string178 = /\\mssqlclient\.py/ nocase ascii wide
                        $string179 = /\\mssqlinstance\.py/ nocase ascii wide
                        $string180 = /\\netview\.py/ nocase ascii wide
                        $string181 = /\\nmapAnswerMachine\.exe/ nocase ascii wide
                        $string182 = /\\nmapAnswerMachine\.py/ nocase ascii wide
                        $string183 = /\\ntfs\-read\.py/ nocase ascii wide
                        $string184 = /\\ntlm\.py/ nocase ascii wide
                        $string185 = /\\ntlmrelayx\.exe/ nocase ascii wide
                        $string186 = /\\ntlmrelayx\.exe/ nocase ascii wide
                        $string187 = /\\ntlmrelayx\.py/ nocase ascii wide
                        $string188 = /\\ntlmrelayx\.py/ nocase ascii wide
                        $string189 = /\\owneredit\.py/ nocase ascii wide
                        $string190 = /\\psexec\.py/ nocase ascii wide
                        $string191 = /\\rbcd\.py/ nocase ascii wide
                        $string192 = /\\rdp_check\.py/ nocase ascii wide
                        $string193 = /\\registry\-read\.py/ nocase ascii wide
                        $string194 = /\\rpcdump\.py/ nocase ascii wide
                        $string195 = /\\rpcmap\.py/ nocase ascii wide
                        $string196 = /\\sambaPipe\.py/ nocase ascii wide
                        $string197 = /\\samrdump\.exe/ nocase ascii wide
                        $string198 = /\\samrdump\.py/ nocase ascii wide
                        $string199 = /\\secretsdump\.exe/ nocase ascii wide
                        $string200 = /\\secretsdump\.py/ nocase ascii wide
                        $string201 = /\\services\.py/ nocase ascii wide
                        $string202 = /\\SMB_RPC\\.{0,1000}\.py/ nocase ascii wide
                        $string203 = /\\smbclient\.exe/ nocase ascii wide
                        $string204 = /\\smbclient\.py/ nocase ascii wide
                        $string205 = /\\smbexec\.py/ nocase ascii wide
                        $string206 = /\\smbpasswd\.py/ nocase ascii wide
                        $string207 = /\\smbrelayx\.exe/ nocase ascii wide
                        $string208 = /\\smbrelayx\.py/ nocase ascii wide
                        $string209 = /\\smbserver\.py/ nocase ascii wide
                        $string210 = /\\sniff\.py/ nocase ascii wide
                        $string211 = /\\sniff\.py/ nocase ascii wide
                        $string212 = /\\sniffer\.exe/ nocase ascii wide
                        $string213 = /\\sniffer\.py/ nocase ascii wide
                        $string214 = /\\ticketConverter\.py/ nocase ascii wide
                        $string215 = /\\ticketer\.exe/ nocase ascii wide
                        $string216 = /\\ticketer\.py/ nocase ascii wide
                        $string217 = /\\tstool\.py/ nocase ascii wide
                        $string218 = /\\wmiexec\.py/ nocase ascii wide
                        $string219 = /\\wmipersist\.exe/ nocase ascii wide
                        $string220 = /\\wmipersist\.py/ nocase ascii wide
                        $string221 = /\\wmiquery\.py/ nocase ascii wide
                        $string222 = /_impacket.{0,1000}\.tar\.gz/ nocase ascii wide
                        $string223 = "04080e338ffd161caf57ae0c76b1267210fe2c2a68ede32c52d4efca6e38514a" nocase ascii wide
                        $string224 = "050720C033870D6BC6D8138D662A3AC0AC5B07858A428C594F81B7B1B55AB963" nocase ascii wide
                        $string225 = "05C00EED2E07D2BB64FFC34AA3BA0A8D9F0DE71909ABA35706A074F23285F83B" nocase ascii wide
                        $string226 = "10244cbbce7a1608b471e26612dbc9ed658d4dde66f5075d6becb5834df8af8b" nocase ascii wide
                        $string227 = "14a2502eebb62133aad519e2717558388f459a4fe281566fbeb0251b0ab2611b" nocase ascii wide
                        $string228 = "1917921CEF704F71B692C3EC0D238FE98AF8EF1EE20CACAAD67FBC3BB885EE9A" nocase ascii wide
                        $string229 = "1B826591784D6FBFB1BED96065D7EBD9982723D3EEC2386614088AAA4CA84F0D" nocase ascii wide
                        $string230 = "1CB9BB2AEE8B6A248427185F165AD3FDDAE8EA923D338C40E93E6F47F1C3F351" nocase ascii wide
                        $string231 = "1DCD5A4349F3E617AF53DCFA24600FD169CFDD53DECE33FD72C6D66C2991D240" nocase ascii wide
                        $string232 = "25d89bd7da43e326b9bfadeae2c256cf1f06c8522b475d43baecf309b2fa6da7" nocase ascii wide
                        $string233 = "26af9c0734525448e4a8d56c9c7b05df0146497ec71101c33812f3f3503201eb" nocase ascii wide
                        $string234 = "2D4A23D2A7F25F007CB0B5E17F50B6B84C09560BFB3232B176E74AE4F97B3E89" nocase ascii wide
                        $string235 = "379F3514AA07B5A9783639932C3ABF48F68742FE4B65C4A94436632C2AB53AFC" nocase ascii wide
                        $string236 = "3979fa127a6e7b52d76b4b92fa2fd3be3d51acfcf109da79ac51ab812cc16098" nocase ascii wide
                        $string237 = "3A128F79ABB162476A7677270884213C983E3F07A4850C930C8F9E7BEB38EB50" nocase ascii wide
                        $string238 = "404cf0d13d243deeeb2b94b9bf807164376a916377e537604a576e6036f84e9d" nocase ascii wide
                        $string239 = "41414141-4141-4141-4141-414141414141" nocase ascii wide
                        $string240 = "41a381d6e85d5d47296485417fab7a07c110c98927990415993d75c07f384e3c" nocase ascii wide
                        $string241 = "42c6d6eb1e991b9adbdb2ec6563530d9123bd02dbde27e2a547c25d9feb41473" nocase ascii wide
                        $string242 = "43ebdb62e179113a55ccd4297316532582be71857b85d85ba187cd6146757397" nocase ascii wide
                        $string243 = "44de69934c7cc1b42b995276af916e6a14d8f2170f5de9306ed1e134d8f007de" nocase ascii wide
                        $string244 = "450c54e126cbd38523f6dce014bd30bc95ede55141ffc3360b1dd6989895b28f" nocase ascii wide
                        $string245 = "455a5ed5b8aca163fd8bbc11a06de8b652517c50a32c634f33a6a093d47e3d4e" nocase ascii wide
                        $string246 = "4A5A36539C52FB818E21404B336FC1936B4B5A6AFBB432CD9DB9672F2BAC1B73" nocase ascii wide
                        $string247 = "4bf7e7b595356585599b4b2773b8a463d7b9765c97012dcd5a44eb6d547f6a1d" nocase ascii wide
                        $string248 = "4C244D2DFBC2E2A8803D3F5522D9F4A788A3A38AF3A37D86D6374A56218D29E9" nocase ascii wide
                        $string249 = "4f1fcdf5b4c104fb6585cd73272adc8e31a279dffd5cae84e5e83c685f4830bd" nocase ascii wide
                        $string250 = "5499BC48B9E9289A19E8215F3EE3A7003DC2057D13970BFFFC42231A93E690A9" nocase ascii wide
                        $string251 = "56bb18010f13a33947c24d31f51e16d8c688cf9c753c1d52f79a9ba64e5c0dca" nocase ascii wide
                        $string252 = "5804dab3b58ddd2e4e2a198083e43b3f1759056d33e03d3a26a5c5fc4ce5a5f9" nocase ascii wide
                        $string253 = "596481231C2187836E29D3AA4498211393C5A31FB762548D4415673CB9D21797" nocase ascii wide
                        $string254 = "5978136ED7A5A34BD587D5D9B7E405560461B166983B94897DF0BD85434653EB" nocase ascii wide
                        $string255 = "5ccf7538e23279696252e4ff25a453d2e3693c76d5c2ffce705e8b9b8c1fe1b5" nocase ascii wide
                        $string256 = "5CF031648822442C641F601094E922898DFA3D93C8D0B3E44FBCE22F43E7E402" nocase ascii wide
                        $string257 = "5f8c475f1a4772644bbae8e3a31e11e78b7f44a1559f5e6bb58b7b3b9083323d" nocase ascii wide
                        $string258 = "65E26974FA14B95E42DE9662308EAC9042E06DD5FDC0987BC1D73FEF2ED2F4FD" nocase ascii wide
                        $string259 = "66924A72494CDBBE223AE81A49AAA2A47DAD741CBC5D180FA85C66ACE641DC35" nocase ascii wide
                        $string260 = "6844B720CFF6E079879333D6FDA944D3D3EA78878B48AFFD45AC81700BBA0F5E" nocase ascii wide
                        $string261 = "6eab9e77c73f2eedae88d1b7cc7b7f2b5f23dc5c7a6110a50a1167ccfcb53769" nocase ascii wide
                        $string262 = "7133a7bae7094a163a75a072f6859a89b54326a111b86af5084fb88206bb89a1" nocase ascii wide
                        $string263 = "723D2DE5B3168EE39FAADD70DCCE691FAE5968D446B8CF47AEA7B29782C02D77" nocase ascii wide
                        $string264 = "7794d2cb665c264f4cda6652c30e727965a5f5ea10e258df5d00d9765ee24910" nocase ascii wide
                        $string265 = "78a28021014c880da7336b529ed813f42c4a79fdc86d8ad38a579744abfcb71b" nocase ascii wide
                        $string266 = "7a4f5e4e4a422a58994593c27fc6e9772072ad573ff22483f1b6913f9bbe70ad" nocase ascii wide
                        $string267 = "7c60f8bb63b494964ea495a4ccdfd5a5370c2b9317f26c8bfa1d4070cc4cebe4" nocase ascii wide
                        $string268 = "7DB2951389A8839D1CC00088A7A2C2432B396D742CABEEC317C02C7B8564250D" nocase ascii wide
                        $string269 = "8248D38639F4808913BB926B20C9AB1B31908BCE8C3A564FF496A8883DE01C97" nocase ascii wide
                        $string270 = "831d70eff6225d3ca5ed5723f7d17c5b7f7f7aaad583e6b0a7d8dd99cdcde755" nocase ascii wide
                        $string271 = "8c866a47872113274363ad6f3ca399d6e3cb45b99ce5e47a579ef1eb31fb0bcf" nocase ascii wide
                        $string272 = "8e71740b1b1dd564dc2c05bb1e355baef9d0ab9bb14fafd91df60ba0998af866" nocase ascii wide
                        $string273 = "8EE4FF2A394B4683DA7E1BCB76010F184A587BFBF41E2853CE4E007ABDD9B75E" nocase ascii wide
                        $string274 = "8F6EB0768AB3620A60AC80E9A1E14F83BD7332E8AFC00092FD4768C8686DA87E" nocase ascii wide
                        $string275 = "904A001AD82F09CD0CB1E1945B29F9120BEB603F7D116BD27A18E6A74DB6B53A" nocase ascii wide
                        $string276 = "912f812564e87c31a162cfe0626f3a6cbc5b6864deedbfefc31f6d321859ade3" nocase ascii wide
                        $string277 = "959818e89008c47a0f515ac6f000163c9ff6a9a0cc094d42d1a823ab3f461d22" nocase ascii wide
                        $string278 = "963119C10E2DC7140A57BCD3456279C5AB4E9E2A3415F91E93BB5F8D8239D996" nocase ascii wide
                        $string279 = "9C2282F1A49F43F1F541DD57C539C6B73D59E8924382B96B23881B85AC333928" nocase ascii wide
                        $string280 = "9d28971b2a831336162f0d303cc1c7400e5876a968f2c6553b46c852ee121504" nocase ascii wide
                        $string281 = "9d3244ba1396ef5d4f5ee375dfa00971f5e6ed20aa2705c570497c78b9948ea8" nocase ascii wide
                        $string282 = "9dbb7cd0d0bc25a9ead8ef4a6b2635c503a4b1f60b62490abf0a068b1108ebff" nocase ascii wide
                        $string283 = "9ECA7D150BA4BF6458ECA88EC6083DDEE2113202C68D07F6E7BC521333D0CE10" nocase ascii wide
                        $string284 = "9EDF1E70CDCE89E9AE400305C24CD202EC348D38E464F61180D509C5AF569CB3" nocase ascii wide
                        $string285 = "9FF259F26CA9D841AFD5D6AF5B631F6CB267ED602BC50624830DC47EF743483E" nocase ascii wide
                        $string286 = "a836426cb1693f3d72b455ae5ff8315993ea5217047bfca288b56554d717f632" nocase ascii wide
                        $string287 = "A99F07FBB9AD4C798BBF570E4C3FEA33AB95E10479F204BE18041EC07BD8CFFF" nocase ascii wide
                        $string288 = "A9A26EE65BEDB50FD71BF89819EFFBF42E06D40525928F125A161B6395CECB52" nocase ascii wide
                        $string289 = "ab99bbfa0e8addfa9f389a05138f21c9976a07a984c74ea0066c6c2aefe2afde" nocase ascii wide
                        $string290 = /adcsattack\.py/ nocase ascii wide
                        $string291 = /addcomputer\.py/ nocase ascii wide
                        $string292 = /admin\.kirbi/ nocase ascii wide
                        $string293 = /atexec\.py/ nocase ascii wide
                        $string294 = "b8eb020a2cbb47146669cfe31c64bb2e7d6499d049c493d6418b9716f5c74583" nocase ascii wide
                        $string295 = "b9de1ac4e68a0c4be90109880892b3b34a296d02102d94f1f79913fcd4806922" nocase ascii wide
                        $string296 = /c\:\\__output/ nocase ascii wide
                        $string297 = "C1E1BD733564A70F30B59BC7B8067BF47512D70D71C15B18F49B5BEC2891CB44" nocase ascii wide
                        $string298 = /cat\s.{0,1000}\.ntds/ nocase ascii wide
                        $string299 = /changepasswd\.py/ nocase ascii wide
                        $string300 = /cmd\.exe\s\/C\stasklist\s\/m\s\>\sC\:\\Windows\\Temp\\.{0,1000}\.tmp\s2\>\&1/ nocase ascii wide
                        $string301 = /cmd\.exe\s\/Q\s\/c\s.{0,1000}\s1\>\s.{0,1000}\\\\127\.0\.0\.1\\ADMIN\$\\__.{0,1000}\s2\>\&1/ nocase ascii wide
                        $string302 = /cmd\.exe\s\/Q\s\/c\scd\s\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\_.{0,1000}\>\&1/ nocase ascii wide
                        $string303 = /cmd\.exe\s\/Q\s\/c\scd\s\\\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\__.{0,1000}\s2\>\&1/ nocase ascii wide
                        $string304 = /cmd\.exe\s\/Q\s\/c\secho\stasklist\s\^\>\s\\\\127\.0\.0\.1\\C\$\\__.{0,1000}2\^\>\^\&1\s\>\s/ nocase ascii wide
                        $string305 = /cmd\.exe\s\/Q\s\/c\swhoami\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\_.{0,1000}2\>\&1/ nocase ascii wide
                        $string306 = /cmd\.exe\\"\s\/C\stasklist\s\/m\s\>\sC\:\\Windows\\Temp\\.{0,1000}\.tmp\s2\>\&1/ nocase ascii wide
                        $string307 = /cmd\.exe\\"\s\/Q\s\/c\scd\s\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\_.{0,1000}\>\&1/ nocase ascii wide
                        $string308 = /cmd\.exe\\"\s\/Q\s\/c\scd\s\\\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\__.{0,1000}\s2\>\&1/ nocase ascii wide
                        $string309 = /cmd\.exe\\"\s\/Q\s\/c\swhoami\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\_.{0,1000}2\>\&1/ nocase ascii wide
                        $string310 = /cmd\:who\s\|\snc\s\-u\s/ nocase ascii wide
                        $string311 = "convert_ccache_to_kirbi" nocase ascii wide
                        $string312 = "convert_kirbi_to_ccache" nocase ascii wide
                        $string313 = "D52008450F6AD0DBB4C8E5596B97A322DAC76CC6A59C9D0CB1AF26D09CC2E013" nocase ascii wide
                        $string314 = "db7c237e7fe7b5bed6b1d63082f21810eb2f0defdf2663de2e7871bb6f24472d" nocase ascii wide
                        $string315 = "db8b7152534b483ed966cd9557bed083106b448feea5e06d6963c0bd7b282f40" nocase ascii wide
                        $string316 = /dcomexec\.py/ nocase ascii wide
                        $string317 = /dcsyncattack\.py/ nocase ascii wide
                        $string318 = /dcsyncclient\.py/ nocase ascii wide
                        $string319 = "DD5BAEEE88AA8F4EF1A0421214C5D42F28786C84C8A4C3C3C3C8897F553D9347" nocase ascii wide
                        $string320 = /dpapi\.py/ nocase ascii wide
                        $string321 = /DumpNTLMInfo\.py/ nocase ascii wide
                        $string322 = "E2778331DA361353B5A445FBD4488418BD25F19FBB931AB39FD9E005137153E8" nocase ascii wide
                        $string323 = "E2E5C254A2E4BDC4926B6CAD49F0F0FE3933B436DE232C85C900C41A16888F55" nocase ascii wide
                        $string324 = "E300339058A885475F5952FB4E9FAAA09BB6EAC26757443017B281C46B03108B" nocase ascii wide
                        $string325 = "e58b8ccccb9d997328877f89fa748bc62b4c4b29945abd2a1d8d60b55a84811a" nocase ascii wide
                        $string326 = "e97d6c8f6d2fc73bceefac93fdfa2c4724a68e58b26e4c2631e78580f2722d2a" nocase ascii wide
                        $string327 = "e97d6c8f6d2fc73bceefac93fdfa2c4724a68e58b26e4c2631e78580f2722d2a" nocase ascii wide
                        $string328 = "ee27cb1d6e87e293f1fa91adb5870328890990e941d1fabe5cb4565fb4795a21" nocase ascii wide
                        $string329 = "ee4039b4d2aede8f5f64478bc59faac86036796be24dea8dc18f009fb0905e4a" nocase ascii wide
                        $string330 = /examples\/netview\.py/ nocase ascii wide
                        $string331 = "f1ddf8432a3f2db1ab2b679abaeaccd61fc601cf2e45cf0f95d169759bc6eaf2" nocase ascii wide
                        $string332 = "F2BA8C8961B3624BDB06DA8025CE8BB39B0375CA78CB4E52FE0259613FE6CEBD" nocase ascii wide
                        $string333 = "f4257657ae5bf141b31cd56db96ac003687be4eb404d1245e27256307e0b5d35" nocase ascii wide
                        $string334 = "FC94F7F1F60026351DF16E3F9681E37BAA7491694DD7C5EA2CBE4B4F62602963" nocase ascii wide
                        $string335 = "FF3347B5A5D4392C5B9D571E9A52DEEE018BEFE78D67A0F096CB995BCA7B1186" nocase ascii wide
                        $string336 = /findDelegation\.py/ nocase ascii wide
                        $string337 = "-force-forwardableet-ADComputer" nocase ascii wide
                        $string338 = "fortra/impacket" nocase ascii wide
                        $string339 = /FrameManagementAssociationRequest\.py/ nocase ascii wide
                        $string340 = /FrameManagementDeauthentication\.py/ nocase ascii wide
                        $string341 = /FrameManagementProbeRequest\.py/ nocase ascii wide
                        $string342 = /FrameManagementReassociationResponse\.py/ nocase ascii wide
                        $string343 = /from\s\.ccache\simport\sCcache/ nocase ascii wide
                        $string344 = /from\simpacket\./ nocase ascii wide
                        $string345 = /GetADUsers\.py/ nocase ascii wide
                        $string346 = /Get\-GPPPassword\.py/ nocase ascii wide
                        $string347 = /GetNPUsers\.py/ nocase ascii wide
                        $string348 = /getPac\.py/ nocase ascii wide
                        $string349 = /getTGT\.py/ nocase ascii wide
                        $string350 = /GetUserSPNs\./ nocase ascii wide
                        $string351 = /goldenPac\.py/ nocase ascii wide
                        $string352 = /http\:\/\/127\.0\.0\.1\:9090\// nocase ascii wide
                        $string353 = "http://localhost:9090/" nocase ascii wide
                        $string354 = /httpattack\.py/ nocase ascii wide
                        $string355 = /httpattacks\/.{0,1000}\.py/ nocase ascii wide
                        $string356 = /httprelayclient\.py/ nocase ascii wide
                        $string357 = /httprelayserver\.py/ nocase ascii wide
                        $string358 = /imapattack\.py/ nocase ascii wide
                        $string359 = /imaprelayclient\.py/ nocase ascii wide
                        $string360 = "impacket" nocase ascii wide
                        $string361 = "impacket" nocase ascii wide
                        $string362 = /impacket\-.{0,1000}\s/ nocase ascii wide
                        $string363 = /impacket\-.{0,1000}\.tar\.gz/ nocase ascii wide
                        $string364 = /\'impacket\./ nocase ascii wide
                        $string365 = /impacket\.git/ nocase ascii wide
                        $string366 = /impacket\.ImpactPacket/ nocase ascii wide
                        $string367 = /impacket\.krb5\.asn1/ nocase ascii wide
                        $string368 = /impacket\.krb5\.ccache/ nocase ascii wide
                        $string369 = /impacket\.krb5\.kerberosv5/ nocase ascii wide
                        $string370 = /impacket\.ldap/ nocase ascii wide
                        $string371 = /impacket\.msada_guids/ nocase ascii wide
                        $string372 = /impacket\.ntlm/ nocase ascii wide
                        $string373 = /impacket\/.{0,1000}\.py/ nocase ascii wide
                        $string374 = "impacket:latest" nocase ascii wide
                        $string375 = "impacket:latest" nocase ascii wide
                        $string376 = "impacket__init__" nocase ascii wide
                        $string377 = "impacket-atexec" nocase ascii wide
                        $string378 = "impacket-dcomexec" nocase ascii wide
                        $string379 = "impacket-GetADUsers" nocase ascii wide
                        $string380 = "impacket-GetNPUsers" nocase ascii wide
                        $string381 = "impacket-getST" nocase ascii wide
                        $string382 = "impacket-getTGT" nocase ascii wide
                        $string383 = "impacketldap_shell" nocase ascii wide
                        $string384 = "impacketlogger" nocase ascii wide
                        $string385 = "impacket-lookupsid" nocase ascii wide
                        $string386 = "impacketmssqlshell" nocase ascii wide
                        $string387 = "impacket-netview" nocase ascii wide
                        $string388 = "impacketntlmrelayx" nocase ascii wide
                        $string389 = "impacketos_ident" nocase ascii wide
                        $string390 = "impacket-psexec" nocase ascii wide
                        $string391 = "impacket-reg" nocase ascii wide
                        $string392 = "impacket-reg" nocase ascii wide
                        $string393 = "impacketremcomsvc" nocase ascii wide
                        $string394 = "impacketrpcdatabase" nocase ascii wide
                        $string395 = "impacket-rpcdump" nocase ascii wide
                        $string396 = "impacket-samrdump" nocase ascii wide
                        $string397 = "impacketsecretsdump" nocase ascii wide
                        $string398 = "impacket-secretsdump" nocase ascii wide
                        $string399 = "impacket-secretsdump" nocase ascii wide
                        $string400 = "impacketserviceinstall" nocase ascii wide
                        $string401 = "impacket-services" nocase ascii wide
                        $string402 = "impacketsmbclient" nocase ascii wide
                        $string403 = "impacket-smbclient" nocase ascii wide
                        $string404 = "impacket-smbserver" nocase ascii wide
                        $string405 = "impacket-ticketer" nocase ascii wide
                        $string406 = "impacketutils" nocase ascii wide
                        $string407 = "impacket-wmiexec" nocase ascii wide
                        $string408 = "ImpactDecoder" nocase ascii wide
                        $string409 = "ImpactPacket" nocase ascii wide
                        $string410 = "import impacket" nocase ascii wide
                        $string411 = "is_kirbi_file" nocase ascii wide
                        $string412 = /karmaSMB\.py/ nocase ascii wide
                        $string413 = /kerberos\-ldap\-password\-hunter\.sh/ nocase ascii wide
                        $string414 = /kerberosv5\.py/ nocase ascii wide
                        $string415 = /keylistattack\.py/ nocase ascii wide
                        $string416 = /kintercept\.py/ nocase ascii wide
                        $string417 = /kintercept\.py/ nocase ascii wide
                        $string418 = "krbrelayx" nocase ascii wide
                        $string419 = /ldapasn1\.py/ nocase ascii wide
                        $string420 = /ldapattack\.py/ nocase ascii wide
                        $string421 = "LDAP-Password-Hunter" nocase ascii wide
                        $string422 = /ldaprelayclient\.py/ nocase ascii wide
                        $string423 = "loadKirbiFile" nocase ascii wide
                        $string424 = /lookupsid\.py/ nocase ascii wide
                        $string425 = /mimikatz\.py/ nocase ascii wide
                        $string426 = /mimilib\.py/ nocase ascii wide
                        $string427 = /mqtt_check\.py/ nocase ascii wide
                        $string428 = /mssqlattack\.py/ nocase ascii wide
                        $string429 = /mssqlrelayclient\./ nocase ascii wide
                        $string430 = /ndDelegation\.py/ nocase ascii wide
                        $string431 = /netview\.py/ nocase ascii wide
                        $string432 = /nmapAnswerMachine\.py/ nocase ascii wide
                        $string433 = /ntfs\-read\.py/ nocase ascii wide
                        $string434 = /ntlm\.py\s/ nocase ascii wide
                        $string435 = /ntlmrelayx\./ nocase ascii wide
                        $string436 = /ntlmrelayx\.exe/ nocase ascii wide
                        $string437 = /ntlmrelayx\.py_to_exe/ nocase ascii wide
                        $string438 = /ntlmrelayx_original\.py/ nocase ascii wide
                        $string439 = "package=impacket" nocase ascii wide
                        $string440 = /pcap_linktypes\.py/ nocase ascii wide
                        $string441 = /pcapfile\.py/ nocase ascii wide
                        $string442 = "Permits to backup a DACL before a modification" nocase ascii wide
                        $string443 = "pip install impacket" nocase ascii wide
                        $string444 = /powershell\.exe\s\-NoP\s\-NoL\s\-sta\s\-NonI\s\-W\sHidden\s\-Exec\sBypass\s\-Enc\s/ nocase ascii wide
                        $string445 = /psexec\.py/ nocase ascii wide
                        $string446 = /raiseChild\.py/ nocase ascii wide
                        $string447 = /rawrelayserver\.py/ nocase ascii wide
                        $string448 = /rbcd\.py/ nocase ascii wide
                        $string449 = /rdp_check\.py/ nocase ascii wide
                        $string450 = /registry\-read\.py/ nocase ascii wide
                        $string451 = /relay.{0,1000}\/utils\/enum\.py/ nocase ascii wide
                        $string452 = /rpcattack\.py/ nocase ascii wide
                        $string453 = /rpcdump\.py/ nocase ascii wide
                        $string454 = /rpcmap\.py/ nocase ascii wide
                        $string455 = /rpcrelayclient\./ nocase ascii wide
                        $string456 = /sambaPipe\.py/ nocase ascii wide
                        $string457 = /samrdump\.py/ nocase ascii wide
                        $string458 = /secretsdump\.py/ nocase ascii wide
                        $string459 = /secretsdump\.py/ nocase ascii wide
                        $string460 = /secretsdump\.py/ nocase ascii wide
                        $string461 = /smbattack\.py/ nocase ascii wide
                        $string462 = /smbexec\.py/ nocase ascii wide
                        $string463 = /smbpasswd\.py/ nocase ascii wide
                        $string464 = /smbrelayclient\.py/ nocase ascii wide
                        $string465 = /smbrelayserver\.py/ nocase ascii wide
                        $string466 = /smbrelayx\.py/ nocase ascii wide
                        $string467 = /smbserver\.py/ nocase ascii wide
                        $string468 = /smtprelayclient\.py/ nocase ascii wide
                        $string469 = /sniffer\.py/ nocase ascii wide
                        $string470 = /tcpshell\.py/ nocase ascii wide
                        $string471 = "test_ccache_fromKirbi" nocase ascii wide
                        $string472 = /ticketConverter\.py/ nocase ascii wide
                        $string473 = /ticketer\.py/ nocase ascii wide
                        $string474 = /wcfrelayserver\.py/ nocase ascii wide
                        $string475 = /winregistry\.py/ nocase ascii wide
                        $string476 = /wmipersist\.py/ nocase ascii wide

    condition:
        any of them
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

001176b2-21b5-4f23-841e-69eb8cd80a18
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
