rule_AD_exploitation_cheat_sheet_offensive_tool_keyword

YARA detection rule by @mthcht · NOASSERTION

Detection patterns for the tool 'AD exploitation cheat sheet' taken from the ThreatHunting-Keywords github project

rule rule_AD_exploitation_cheat_sheet_offensive_tool_keyword
{
    meta:
        description = "Detection patterns for the tool 'AD exploitation cheat sheet' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "AD exploitation cheat sheet"
        rule_category = "offensive_tool_keyword"

    strings:
                        $string1_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\/user\:.{0,100}\s\/domain\:.{0,100}\s\/aes256\:.{0,100}\s\/run\:powershell\.exe/ nocase ascii wide
                        $string2_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\/user\:.{0,100}\s\/domain\:.{0,100}\s\/ntlm\:.{0,100}\s\/run\:powershell\.exe/ nocase ascii wide
                        $string3_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\/user\:.{0,100}\s\/domain\:.{0,100}\s\/sid\:S\-1\-5\-21\-.{0,100}\s\/krbtgt\:.{0,100}\s\/id\:.{0,100}\s\/groups\:.{0,100}\s\/startoffset\:0\s\/endin\:600\s\/renewmax\:10080\s\/ptt/ nocase ascii wide
                        $string4_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\-FakeDC\s.{0,100}\s\-SamAccountName\s.{0,100}\s\-Username\s/ nocase ascii wide
                        $string5_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\-Identity\s.{0,100}\s\-Set\s\@\{serviceprincipalname\=\'.{0,100}\'\}/ nocase ascii wide
                        $string6_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\-Identity\s.{0,100}\s\-XOR\s\@\{useraccountcontrol\=4194304/ nocase ascii wide
                        $string7_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\slsass\.dmp/ nocase ascii wide
                        $string8_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\s\-\-no\-http\-server\s\-smb2support\s\-t\s.{0,100}\s\-c\s/ nocase ascii wide
                        $string9_AD_exploitation_cheat_sheet_offensive_tool_keyword = " server -p 80 --reverse --socks5"
                        $string10_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.\/chisel\s/
                        $string11_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sasktgt\s\/user\:.{0,100}\s\/aes256\:.{0,100}\s\/opsec\s\/ptt/ nocase ascii wide
                        $string12_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sasktgt\s\/user\:.{0,100}\s\/rc4\:.{0,100}\s\/createnetonly\:.{0,100}cmd\.exe/ nocase ascii wide
                        $string13_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sasktgt\s\/user\:.{0,100}\s\/rc4\:.{0,100}\s\/ptt/ nocase ascii wide
                        $string14_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sclient\s.{0,100}\:.{0,100}\sR\:socks/ nocase ascii wide
                        $string15_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sdump\s\/luid\:0x5379f2\s\/nowrap/ nocase ascii wide
                        $string16_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\smonitor\s\/interval\:5\s\/nowrap/ nocase ascii wide
                        $string17_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\sptt\s\/ticket\:/ nocase ascii wide
                        $string18_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\ss4u\s\/ticket\:.{0,100}\s\/impersonateuser\:.{0,100}\s\/msdsspn\:.{0,100}\s\/ptt/ nocase ascii wide
                        $string19_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\ss4u\s\/user\:.{0,100}\s\/impersonateuser\:.{0,100}\s\/msdsspn\:.{0,100}\s\/altservice\:ldap\s\/ptt\s\/rc4/ nocase ascii wide
                        $string20_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.exe\striage/ nocase ascii wide
                        $string21_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\.xp_dirtree\s.{0,100}\\/ nocase ascii wide
                        $string22_AD_exploitation_cheat_sheet_offensive_tool_keyword = /\/rockyou\.txt/
                        $string23_AD_exploitation_cheat_sheet_offensive_tool_keyword = /10k\-worst\-pass\.txt/ nocase ascii wide
                        $string24_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Add-RemoteRegBackdoor" nocase ascii wide
                        $string25_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Assembly\.GetType\(\'System\.Management\.Automation\.AmsiUtils\'\)\.GetField\(\'amsiInitFailed\'.{0,100}\'NonPublic.{0,100}Static\'\)\.SetValue\(\$null.{0,100}\$true\)/ nocase ascii wide
                        $string26_AD_exploitation_cheat_sheet_offensive_tool_keyword = /chisel\.exe\s/ nocase ascii wide
                        $string27_AD_exploitation_cheat_sheet_offensive_tool_keyword = /copy\s\\.{0,100}\\HarddiskVolumeShadowCopy1\\windows\\system32\\config\\sam\sC\:\\/ nocase ascii wide
                        $string28_AD_exploitation_cheat_sheet_offensive_tool_keyword = /copy\s\\.{0,100}\\HarddiskVolumeShadowCopy1\\windows\\system32\\config\\system\sC\:\\/ nocase ascii wide
                        $string29_AD_exploitation_cheat_sheet_offensive_tool_keyword = /echo\s\-n\s\'cmd\s\/c\sstart\srundll32\s.{0,100}\.dll.{0,100}\s\|\sbase64/ nocase ascii wide
                        $string30_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Find-InterestingDomainAcl" nocase ascii wide
                        $string31_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Find-LocalAdminAccess" nocase ascii wide
                        $string32_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-ASREPHash" nocase ascii wide
                        $string33_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Get\-DomainComputer\s\-TrustedToAuth\s\|\sselect\sname/ nocase ascii wide
                        $string34_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-DomainForeignGroupMember" nocase ascii wide
                        $string35_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Get\-DomainUser\s\-TrustedToAuth\s\|\sselect\suserprincipalname/ nocase ascii wide
                        $string36_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Get\-ItemProperty\s\-Path\sHKLM\:\\Software\\TightVNC\\Server\s\-Name\s.{0,100}Password.{0,100}\s\|\sselect\s\-ExpandProperty\sPassword/ nocase ascii wide
                        $string37_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Get\-ItemProperty\s\-Path\sHKLM\:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\s\-Name\s.{0,100}RunAsPPL/ nocase ascii wide
                        $string38_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-RemoteCachedCredential" nocase ascii wide
                        $string39_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-RemoteLocalAccountHash" nocase ascii wide
                        $string40_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-RemoteMachineAccountHash" nocase ascii wide
                        $string41_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Get-SqlServerLinkCrawl" nocase ascii wide
                        $string42_AD_exploitation_cheat_sheet_offensive_tool_keyword = "impacket-wmiexec"
                        $string43_AD_exploitation_cheat_sheet_offensive_tool_keyword = /incognito.{0,100}\slist_tokens\s\-u/ nocase ascii wide
                        $string44_AD_exploitation_cheat_sheet_offensive_tool_keyword = /incognito\.exe/ nocase ascii wide
                        $string45_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Invoke-AllChecks" nocase ascii wide
                        $string46_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Invoke-ServiceAbuse" nocase ascii wide
                        $string47_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Invoke-SQLAudit" nocase ascii wide
                        $string48_AD_exploitation_cheat_sheet_offensive_tool_keyword = /Invoke\-SQLOSCmd\s\-Instance\s.{0,100}\s\-Command\s/ nocase ascii wide
                        $string49_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Invoke-TokenManipulation" nocase ascii wide
                        $string50_AD_exploitation_cheat_sheet_offensive_tool_keyword = /lsass\.dmp/ nocase ascii wide
                        $string51_AD_exploitation_cheat_sheet_offensive_tool_keyword = /MS\-RPRN\.exe\s/ nocase ascii wide
                        $string52_AD_exploitation_cheat_sheet_offensive_tool_keyword = /mssqlsvc\.kirbi/ nocase ascii wide
                        $string53_AD_exploitation_cheat_sheet_offensive_tool_keyword = "ntlmrelayx --" nocase ascii wide
                        $string54_AD_exploitation_cheat_sheet_offensive_tool_keyword = /procdump\.exe.{0,100}lsass/ nocase ascii wide
                        $string55_AD_exploitation_cheat_sheet_offensive_tool_keyword = /pwd.{0,100}\/.{0,100}\/rules\/best64\.rule/ nocase ascii wide
                        $string56_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Set-DCShadowPermissions" nocase ascii wide
                        $string57_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Set-DomainObject" nocase ascii wide
                        $string58_AD_exploitation_cheat_sheet_offensive_tool_keyword = /sET\-ItEM\s\(\s\'V\'\+\'aR\'\s\+\s\s\'IA\'\s\+\s\'blE\:1q2\'\s\s\+\s\'uZx\'/ nocase ascii wide
                        $string59_AD_exploitation_cheat_sheet_offensive_tool_keyword = "SharpBypassUAC" nocase ascii wide
                        $string60_AD_exploitation_cheat_sheet_offensive_tool_keyword = /tgsrepcrack\./ nocase ascii wide
                        $string61_AD_exploitation_cheat_sheet_offensive_tool_keyword = /token.{0,100}\s\-CreateProcess\s.{0,100}\s\-ProcessId\s/ nocase ascii wide
                        $string62_AD_exploitation_cheat_sheet_offensive_tool_keyword = /token.{0,100}\s\-ImpersonateUser\s\-Username\s/ nocase ascii wide
                        $string63_AD_exploitation_cheat_sheet_offensive_tool_keyword = "use incognito" nocase ascii wide
                        $string64_AD_exploitation_cheat_sheet_offensive_tool_keyword = /wmic\sshadowcopy\scall\screate\sVolume\=\'C\:\\\'/ nocase ascii wide
                        $string65_AD_exploitation_cheat_sheet_offensive_tool_keyword = "Write-ServiceBinary" nocase ascii wide
        $metadata_regex_import = /\bimport\s+[a-zA-Z0-9_.]+\b/ nocase
        $metadata_regex_function = /function\s+[a-zA-Z_][a-zA-Z0-9_]*\(/ nocase ascii
        $metadata_regex_php = /<\?php/ nocase ascii
        $metadata_regex_createobject = /(CreateObject|WScript\.)/ nocase ascii
        $metadata_regex_script = /<script\b/ nocase ascii
        $metadata_regex_javascript = /(let\s|const\s|function\s|document\.|console\.)/ nocase ascii
        $metadata_regex_powershell = /(Write-Host|Get-[a-zA-Z]+|Invoke-|param\(|\.SYNOPSIS)/ nocase ascii
        $metadata_regex_batch = /@(echo\s|call\s|set\s|goto\s|if\s|for\s|rem\s)/ nocase ascii
        $metadata_regex_shebang = /^#!\// nocase ascii

    condition:
        ((filesize < 20MB and (
            uint16(0) == 0x5a4d or             uint16(0) == 0x457f or             uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or             uint32(0) == 0x504B0304 or             uint32(0) == 0xCAFEBABE or             uint32(0) == 0x4D534346 or             uint32(0) == 0xD0CF11E0 or             uint16(0) == 0x2321 or             uint16(0) == 0x3c3f         )) and 2 of ($string*)) or
        (filesize < 2MB and
        (
            2 of ($string*) and
            for any of ($metadata_regex_*) : ( @ <= 20000 )
        ))
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

bffe8d7f-bc97-4af2-8766-d1530b7e379a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion