rule_impacket_offensive_tool_keyword

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'impacket' taken from the ThreatHunting-Keywords github project
rule rule_impacket_offensive_tool_keyword
{
    meta:
        description = "Detection patterns for the tool 'impacket' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "impacket"
        rule_category = "offensive_tool_keyword"

    strings:
                        $string1_impacket_offensive_tool_keyword = /\s\/Q\s\/C\s\>1\s\\\\127\.0\.01\\ADMIN\$\\__/ nocase ascii wide
                        $string2_impacket_offensive_tool_keyword = " -brute-opnums " nocase ascii wide
                        $string3_impacket_offensive_tool_keyword = " -brute-uuids " nocase ascii wide
                        $string4_impacket_offensive_tool_keyword = /\sdacledit\.py/ nocase ascii wide
                        $string5_impacket_offensive_tool_keyword = /\s\-dc\-ip\s.{0,100}\s\-so\s/ nocase ascii wide
                        $string6_impacket_offensive_tool_keyword = /\s\-dc\-ip\s.{0,100}\s\-computer\-pass\s/ nocase ascii wide
                        $string7_impacket_offensive_tool_keyword = /\s\-dc\-ip\s.{0,100}\s\-impersonate\s/ nocase ascii wide
                        $string8_impacket_offensive_tool_keyword = /\s\-dc\-ip\s.{0,100}\s\-target\-ip\s/ nocase ascii wide
                        $string9_impacket_offensive_tool_keyword = /\sdump\-lsass\.py/ nocase ascii wide
                        $string10_impacket_offensive_tool_keyword = " -force-forwardable" nocase ascii wide
                        $string11_impacket_offensive_tool_keyword = /\s\-hashes\s.{0,100}\s\-spn\s.{0,100}\s\-impersonate\s/ nocase ascii wide
                        $string12_impacket_offensive_tool_keyword = " impacket" nocase ascii wide
                        $string13_impacket_offensive_tool_keyword = " impacket/" nocase ascii wide
                        $string14_impacket_offensive_tool_keyword = /\s\-impersonate.{0,100}\s\-hashes/ nocase ascii wide
                        $string15_impacket_offensive_tool_keyword = " -just-dc-ntlm  " nocase ascii wide
                        $string16_impacket_offensive_tool_keyword = " -just-dc-user " nocase ascii wide
                        $string17_impacket_offensive_tool_keyword = /\s\-k\s\-request\-user\s.{0,100}\s\-dc\-ip/ nocase ascii wide
                        $string18_impacket_offensive_tool_keyword = " LMHASH:NTHASH" nocase ascii wide
                        $string19_impacket_offensive_tool_keyword = " -no-pass -usersfile " nocase ascii wide
                        $string20_impacket_offensive_tool_keyword = /\s\-ntds\s.{0,100}\.dit\s.{0,100}\-system\s/ nocase ascii wide
                        $string21_impacket_offensive_tool_keyword = /\s\-ntds\sntds\.dit\s\-system\sSYSTEM\s/ nocase ascii wide
                        $string22_impacket_offensive_tool_keyword = /\s\-nthash\s.{0,100}\s\-domain\-sid\s/ nocase ascii wide
                        $string23_impacket_offensive_tool_keyword = /\sntlm\.py/ nocase ascii wide
                        $string24_impacket_offensive_tool_keyword = /\sntlmrelayx\.py/ nocase ascii wide
                        $string25_impacket_offensive_tool_keyword = " PrincipalsAllowedToDelegateToAccount " nocase ascii wide
                        $string26_impacket_offensive_tool_keyword = /\s\-sam\s.{0,100}\s\-system\s.{0,100}\s\-security\s.{0,100}\sLOCAL\s\>\s.{0,100}\.out/ nocase ascii wide
                        $string27_impacket_offensive_tool_keyword = " --shadow-credentials --shadow-target " nocase ascii wide
                        $string28_impacket_offensive_tool_keyword = /\s\-spn\scifs\/.{0,100}\s\-hashes/ nocase ascii wide
                        $string29_impacket_offensive_tool_keyword = /\s\-system\sSYSTEM\s\-ntds\sNTDS\.dit\sLOCAL/ nocase ascii wide
                        $string30_impacket_offensive_tool_keyword = /\s\-system\sSYSTEM\s\-ntds\sNTDS\.dit\s\-outputfile/ nocase ascii wide
                        $string31_impacket_offensive_tool_keyword = /\s\-target\-domain\s.{0,100}\s\-outputfile\s.{0,100}\s\-no\-pass/ nocase ascii wide
                        $string32_impacket_offensive_tool_keyword = /\.py\s.{0,100}\s\-k\s\-no\-pass/ nocase ascii wide
                        $string33_impacket_offensive_tool_keyword = /\.py\s\-use\-remoteSSMethod\s/ nocase ascii wide
                        $string34_impacket_offensive_tool_keyword = /\/addcomputer\.py/ nocase ascii wide
                        $string35_impacket_offensive_tool_keyword = /\/atexec\.py/ nocase ascii wide
                        $string36_impacket_offensive_tool_keyword = /\/atexec\.py/ nocase ascii wide
                        $string37_impacket_offensive_tool_keyword = /\/attacks\/.{0,100}\.py/ nocase ascii wide
                        $string38_impacket_offensive_tool_keyword = /\/Certipy\.exe/ nocase ascii wide
                        $string39_impacket_offensive_tool_keyword = /\/changepasswd\.py/
                        $string40_impacket_offensive_tool_keyword = /\/dacledit\.py/ nocase ascii wide
                        $string41_impacket_offensive_tool_keyword = /\/dacledit\.py/ nocase ascii wide
                        $string42_impacket_offensive_tool_keyword = /\/dcomexec\.exe/ nocase ascii wide
                        $string43_impacket_offensive_tool_keyword = /\/dcomexec\.py/ nocase ascii wide
                        $string44_impacket_offensive_tool_keyword = /\/describeTicket\.py/ nocase ascii wide
                        $string45_impacket_offensive_tool_keyword = /\/dpapi\.py/ nocase ascii wide
                        $string46_impacket_offensive_tool_keyword = /\/Dump\-Lsass\.git/ nocase ascii wide
                        $string47_impacket_offensive_tool_keyword = /\/dump\-lsass\.py/ nocase ascii wide
                        $string48_impacket_offensive_tool_keyword = /\/DumpNTLMInfo\.py/ nocase ascii wide
                        $string49_impacket_offensive_tool_keyword = /\/esentutl\.py/ nocase ascii wide
                        $string50_impacket_offensive_tool_keyword = /\/exchanger\.py/ nocase ascii wide
                        $string51_impacket_offensive_tool_keyword = /\/exchanger\.py/ nocase ascii wide
                        $string52_impacket_offensive_tool_keyword = /\/findDelegation\.py/ nocase ascii wide
                        $string53_impacket_offensive_tool_keyword = /\/GetADComputers\.py/ nocase ascii wide
                        $string54_impacket_offensive_tool_keyword = /\/GetADUsers\.py/ nocase ascii wide
                        $string55_impacket_offensive_tool_keyword = /\/getArch\.py/ nocase ascii wide
                        $string56_impacket_offensive_tool_keyword = /\/Get\-GPPPassword\.py/ nocase ascii wide
                        $string57_impacket_offensive_tool_keyword = /\/GetLAPSPassword\.py/ nocase ascii wide
                        $string58_impacket_offensive_tool_keyword = /\/GetNPUsers\.exe/ nocase ascii wide
                        $string59_impacket_offensive_tool_keyword = /\/GetNPUsers\.py/ nocase ascii wide
                        $string60_impacket_offensive_tool_keyword = /\/getOSandSMBproperties\.exe/ nocase ascii wide
                        $string61_impacket_offensive_tool_keyword = /\/getPac\.exe/ nocase ascii wide
                        $string62_impacket_offensive_tool_keyword = /\/getPac\.py/ nocase ascii wide
                        $string63_impacket_offensive_tool_keyword = /\/getST\.py/ nocase ascii wide
                        $string64_impacket_offensive_tool_keyword = /\/getST2\.py/ nocase ascii wide
                        $string65_impacket_offensive_tool_keyword = /\/getTGT\.py/ nocase ascii wide
                        $string66_impacket_offensive_tool_keyword = /\/GetUserSPNs\.py/ nocase ascii wide
                        $string67_impacket_offensive_tool_keyword = /\/goldenPac\.py/ nocase ascii wide
                        $string68_impacket_offensive_tool_keyword = /\/impacket\./ nocase ascii wide
                        $string69_impacket_offensive_tool_keyword = /\/impacket\.git/ nocase ascii wide
                        $string70_impacket_offensive_tool_keyword = "/impacket/" nocase ascii wide
                        $string71_impacket_offensive_tool_keyword = /\/karmaSMB\.exe/ nocase ascii wide
                        $string72_impacket_offensive_tool_keyword = /\/karmaSMB\.py/ nocase ascii wide
                        $string73_impacket_offensive_tool_keyword = "/kerberos-ldap-password-hunter" nocase ascii wide
                        $string74_impacket_offensive_tool_keyword = /\/keylistattack\.py/ nocase ascii wide
                        $string75_impacket_offensive_tool_keyword = /\/kintercept\.py/ nocase ascii wide
                        $string76_impacket_offensive_tool_keyword = /\/krb5\/.{0,100}\.py/ nocase ascii wide
                        $string77_impacket_offensive_tool_keyword = /\/ldap\.py/ nocase ascii wide
                        $string78_impacket_offensive_tool_keyword = /\/lookupsid\.py/ nocase ascii wide
                        $string79_impacket_offensive_tool_keyword = /\/lookupsid\.py/ nocase ascii wide
                        $string80_impacket_offensive_tool_keyword = /\/machine_role\.py/ nocase ascii wide
                        $string81_impacket_offensive_tool_keyword = /\/mimikatz\.py/ nocase ascii wide
                        $string82_impacket_offensive_tool_keyword = /\/mqtt_check\.py/ nocase ascii wide
                        $string83_impacket_offensive_tool_keyword = /\/mssqlclient\.py/ nocase ascii wide
                        $string84_impacket_offensive_tool_keyword = /\/mssqlinstance\.py/ nocase ascii wide
                        $string85_impacket_offensive_tool_keyword = /\/netview\.py/ nocase ascii wide
                        $string86_impacket_offensive_tool_keyword = /\/nmapAnswerMachine\.exe/ nocase ascii wide
                        $string87_impacket_offensive_tool_keyword = /\/nmapAnswerMachine\.py/ nocase ascii wide
                        $string88_impacket_offensive_tool_keyword = /\/ntfs\-read\.py/ nocase ascii wide
                        $string89_impacket_offensive_tool_keyword = /\/ntlm\.py/ nocase ascii wide
                        $string90_impacket_offensive_tool_keyword = /\/ntlmrelayx\.exe/ nocase ascii wide
                        $string91_impacket_offensive_tool_keyword = /\/ntlmrelayx\.exe/ nocase ascii wide
                        $string92_impacket_offensive_tool_keyword = /\/ntlmrelayx\.py/ nocase ascii wide
                        $string93_impacket_offensive_tool_keyword = /\/ntlmrelayx\.py/ nocase ascii wide
                        $string94_impacket_offensive_tool_keyword = /\/owneredit\.py/ nocase ascii wide
                        $string95_impacket_offensive_tool_keyword = /\/ping6\.py/ nocase ascii wide
                        $string96_impacket_offensive_tool_keyword = /\/psexec\.py/ nocase ascii wide
                        $string97_impacket_offensive_tool_keyword = /\/rbcd\.py/ nocase ascii wide
                        $string98_impacket_offensive_tool_keyword = /\/rdp_check\.py/ nocase ascii wide
                        $string99_impacket_offensive_tool_keyword = /\/registry\-read\.py/ nocase ascii wide
                        $string100_impacket_offensive_tool_keyword = "/releases/download/impacket_" nocase ascii wide
                        $string101_impacket_offensive_tool_keyword = /\/rpc\/rpcproxy\.dll\?/ nocase ascii wide
                        $string102_impacket_offensive_tool_keyword = /\/rpcdump\.py/ nocase ascii wide
                        $string103_impacket_offensive_tool_keyword = /\/rpcmap\.py/ nocase ascii wide
                        $string104_impacket_offensive_tool_keyword = /\/sambaPipe\.py/ nocase ascii wide
                        $string105_impacket_offensive_tool_keyword = /\/samrdump\.exe/ nocase ascii wide
                        $string106_impacket_offensive_tool_keyword = /\/samrdump\.py/ nocase ascii wide
                        $string107_impacket_offensive_tool_keyword = /\/secretsdump\.exe/ nocase ascii wide
                        $string108_impacket_offensive_tool_keyword = /\/secretsdump\.py/ nocase ascii wide
                        $string109_impacket_offensive_tool_keyword = /\/smb\.py/ nocase ascii wide
                        $string110_impacket_offensive_tool_keyword = /\/SMB_RPC\/.{0,100}\.py/ nocase ascii wide
                        $string111_impacket_offensive_tool_keyword = /\/smb3\.py/ nocase ascii wide
                        $string112_impacket_offensive_tool_keyword = /\/smbclient\.exe/ nocase ascii wide
                        $string113_impacket_offensive_tool_keyword = /\/smbclient\.py/ nocase ascii wide
                        $string114_impacket_offensive_tool_keyword = /\/smbexec\.py/ nocase ascii wide
                        $string115_impacket_offensive_tool_keyword = /\/smbpasswd\.py/ nocase ascii wide
                        $string116_impacket_offensive_tool_keyword = /\/smbrelayx\.exe/ nocase ascii wide
                        $string117_impacket_offensive_tool_keyword = /\/smbrelayx\.py/ nocase ascii wide
                        $string118_impacket_offensive_tool_keyword = /\/smbserver\.py/ nocase ascii wide
                        $string119_impacket_offensive_tool_keyword = /\/sniff\.py/ nocase ascii wide
                        $string120_impacket_offensive_tool_keyword = /\/sniff\.py/ nocase ascii wide
                        $string121_impacket_offensive_tool_keyword = /\/sniffer\.exe/ nocase ascii wide
                        $string122_impacket_offensive_tool_keyword = /\/sniffer\.py/ nocase ascii wide
                        $string123_impacket_offensive_tool_keyword = /\/ticketConverter\.py/ nocase ascii wide
                        $string124_impacket_offensive_tool_keyword = /\/ticketer\.exe/ nocase ascii wide
                        $string125_impacket_offensive_tool_keyword = /\/ticketer\.py/ nocase ascii wide
                        $string126_impacket_offensive_tool_keyword = /\/winregistry\.py/ nocase ascii wide
                        $string127_impacket_offensive_tool_keyword = /\/wmiexec\.py/ nocase ascii wide
                        $string128_impacket_offensive_tool_keyword = /\/wmipersist\.exe/ nocase ascii wide
                        $string129_impacket_offensive_tool_keyword = /\/wmipersist\.py/ nocase ascii wide
                        $string130_impacket_offensive_tool_keyword = /\/wmiquery\.py/ nocase ascii wide
                        $string131_impacket_offensive_tool_keyword = /\:9090.{0,100}\/api\/v1\.0\/relays/ nocase ascii wide
                        $string132_impacket_offensive_tool_keyword = /\\\$.{0,100}\.kirbi/ nocase ascii wide
                        $string133_impacket_offensive_tool_keyword = /\\\\127\.0\.0\.1\\c\$/ nocase ascii wide
                        $string134_impacket_offensive_tool_keyword = /\\__output\s2\^\>\^\&1\s\>/ nocase ascii wide
                        $string135_impacket_offensive_tool_keyword = /\\__output\s2\>\&1\s\>/ nocase ascii wide
                        $string136_impacket_offensive_tool_keyword = /\\addcomputer\.py/ nocase ascii wide
                        $string137_impacket_offensive_tool_keyword = /\\atexec\.py/ nocase ascii wide
                        $string138_impacket_offensive_tool_keyword = /\\C\$\\__output/ nocase ascii wide
                        $string139_impacket_offensive_tool_keyword = /\\Certipy\.exe/ nocase ascii wide
                        $string140_impacket_offensive_tool_keyword = /\\changepasswd\.py/ nocase ascii wide
                        $string141_impacket_offensive_tool_keyword = /\\dacledit\-.{0,100}\.bak/ nocase ascii wide
                        $string142_impacket_offensive_tool_keyword = /\\dacledit\.py/ nocase ascii wide
                        $string143_impacket_offensive_tool_keyword = /\\dacledit\.py/ nocase ascii wide
                        $string144_impacket_offensive_tool_keyword = /\\dcomexec\.exe/ nocase ascii wide
                        $string145_impacket_offensive_tool_keyword = /\\dcomexec\.py/ nocase ascii wide
                        $string146_impacket_offensive_tool_keyword = /\\describeTicket\.py/ nocase ascii wide
                        $string147_impacket_offensive_tool_keyword = /\\dpapi\.py/ nocase ascii wide
                        $string148_impacket_offensive_tool_keyword = /\\dump\-lsass\.py/ nocase ascii wide
                        $string149_impacket_offensive_tool_keyword = /\\DumpNTLMInfo\.py/ nocase ascii wide
                        $string150_impacket_offensive_tool_keyword = /\\esentutl\.py/ nocase ascii wide
                        $string151_impacket_offensive_tool_keyword = /\\exchanger\.py/ nocase ascii wide
                        $string152_impacket_offensive_tool_keyword = /\\findDelegation\.py/ nocase ascii wide
                        $string153_impacket_offensive_tool_keyword = /\\GetADComputers\.py/ nocase ascii wide
                        $string154_impacket_offensive_tool_keyword = /\\GetADUsers\.py/ nocase ascii wide
                        $string155_impacket_offensive_tool_keyword = /\\getArch\.py/ nocase ascii wide
                        $string156_impacket_offensive_tool_keyword = /\\Get\-GPPPassword\.py/ nocase ascii wide
                        $string157_impacket_offensive_tool_keyword = /\\GetLAPSPassword\.py/ nocase ascii wide
                        $string158_impacket_offensive_tool_keyword = /\\GetNPUsers\.exe/ nocase ascii wide
                        $string159_impacket_offensive_tool_keyword = /\\GetNPUsers\.py/ nocase ascii wide
                        $string160_impacket_offensive_tool_keyword = /\\getOSandSMBproperties\.exe/ nocase ascii wide
                        $string161_impacket_offensive_tool_keyword = /\\getPac\.exe/ nocase ascii wide
                        $string162_impacket_offensive_tool_keyword = /\\getPac\.py/ nocase ascii wide
                        $string163_impacket_offensive_tool_keyword = /\\getST\.py/ nocase ascii wide
                        $string164_impacket_offensive_tool_keyword = /\\getST2\.py/ nocase ascii wide
                        $string165_impacket_offensive_tool_keyword = /\\getTGT\.py/ nocase ascii wide
                        $string166_impacket_offensive_tool_keyword = /\\GetUserSPNs\.py/ nocase ascii wide
                        $string167_impacket_offensive_tool_keyword = /\\goldenPac\.py/ nocase ascii wide
                        $string168_impacket_offensive_tool_keyword = /\\impacket\./ nocase ascii wide
                        $string169_impacket_offensive_tool_keyword = /\\karmaSMB\.exe/ nocase ascii wide
                        $string170_impacket_offensive_tool_keyword = /\\karmaSMB\.py/ nocase ascii wide
                        $string171_impacket_offensive_tool_keyword = /\\keylistattack\.py/ nocase ascii wide
                        $string172_impacket_offensive_tool_keyword = /\\kintercept\.py/ nocase ascii wide
                        $string173_impacket_offensive_tool_keyword = /\\krb5\\.{0,100}\.py/ nocase ascii wide
                        $string174_impacket_offensive_tool_keyword = /\\lookupsid\.py/ nocase ascii wide
                        $string175_impacket_offensive_tool_keyword = /\\machine_role\.py/ nocase ascii wide
                        $string176_impacket_offensive_tool_keyword = /\\mimikatz\.py/ nocase ascii wide
                        $string177_impacket_offensive_tool_keyword = /\\mqtt_check\.py/ nocase ascii wide
                        $string178_impacket_offensive_tool_keyword = /\\mssqlclient\.py/ nocase ascii wide
                        $string179_impacket_offensive_tool_keyword = /\\mssqlinstance\.py/ nocase ascii wide
                        $string180_impacket_offensive_tool_keyword = /\\netview\.py/ nocase ascii wide
                        $string181_impacket_offensive_tool_keyword = /\\nmapAnswerMachine\.exe/ nocase ascii wide
                        $string182_impacket_offensive_tool_keyword = /\\nmapAnswerMachine\.py/ nocase ascii wide
                        $string183_impacket_offensive_tool_keyword = /\\ntfs\-read\.py/ nocase ascii wide
                        $string184_impacket_offensive_tool_keyword = /\\ntlm\.py/ nocase ascii wide
                        $string185_impacket_offensive_tool_keyword = /\\ntlmrelayx\.exe/ nocase ascii wide
                        $string186_impacket_offensive_tool_keyword = /\\ntlmrelayx\.exe/ nocase ascii wide
                        $string187_impacket_offensive_tool_keyword = /\\ntlmrelayx\.py/ nocase ascii wide
                        $string188_impacket_offensive_tool_keyword = /\\ntlmrelayx\.py/ nocase ascii wide
                        $string189_impacket_offensive_tool_keyword = /\\owneredit\.py/ nocase ascii wide
                        $string190_impacket_offensive_tool_keyword = /\\psexec\.py/ nocase ascii wide
                        $string191_impacket_offensive_tool_keyword = /\\rbcd\.py/ nocase ascii wide
                        $string192_impacket_offensive_tool_keyword = /\\rdp_check\.py/ nocase ascii wide
                        $string193_impacket_offensive_tool_keyword = /\\registry\-read\.py/ nocase ascii wide
                        $string194_impacket_offensive_tool_keyword = /\\rpcdump\.py/ nocase ascii wide
                        $string195_impacket_offensive_tool_keyword = /\\rpcmap\.py/ nocase ascii wide
                        $string196_impacket_offensive_tool_keyword = /\\sambaPipe\.py/ nocase ascii wide
                        $string197_impacket_offensive_tool_keyword = /\\samrdump\.exe/ nocase ascii wide
                        $string198_impacket_offensive_tool_keyword = /\\samrdump\.py/ nocase ascii wide
                        $string199_impacket_offensive_tool_keyword = /\\secretsdump\.exe/ nocase ascii wide
                        $string200_impacket_offensive_tool_keyword = /\\secretsdump\.py/ nocase ascii wide
                        $string201_impacket_offensive_tool_keyword = /\\services\.py/ nocase ascii wide
                        $string202_impacket_offensive_tool_keyword = /\\SMB_RPC\\.{0,100}\.py/ nocase ascii wide
                        $string203_impacket_offensive_tool_keyword = /\\smbclient\.exe/ nocase ascii wide
                        $string204_impacket_offensive_tool_keyword = /\\smbclient\.py/ nocase ascii wide
                        $string205_impacket_offensive_tool_keyword = /\\smbexec\.py/ nocase ascii wide
                        $string206_impacket_offensive_tool_keyword = /\\smbpasswd\.py/ nocase ascii wide
                        $string207_impacket_offensive_tool_keyword = /\\smbrelayx\.exe/ nocase ascii wide
                        $string208_impacket_offensive_tool_keyword = /\\smbrelayx\.py/ nocase ascii wide
                        $string209_impacket_offensive_tool_keyword = /\\smbserver\.py/ nocase ascii wide
                        $string210_impacket_offensive_tool_keyword = /\\sniff\.py/ nocase ascii wide
                        $string211_impacket_offensive_tool_keyword = /\\sniff\.py/ nocase ascii wide
                        $string212_impacket_offensive_tool_keyword = /\\sniffer\.exe/ nocase ascii wide
                        $string213_impacket_offensive_tool_keyword = /\\sniffer\.py/ nocase ascii wide
                        $string214_impacket_offensive_tool_keyword = /\\ticketConverter\.py/ nocase ascii wide
                        $string215_impacket_offensive_tool_keyword = /\\ticketer\.exe/ nocase ascii wide
                        $string216_impacket_offensive_tool_keyword = /\\ticketer\.py/ nocase ascii wide
                        $string217_impacket_offensive_tool_keyword = /\\tstool\.py/ nocase ascii wide
                        $string218_impacket_offensive_tool_keyword = /\\wmiexec\.py/ nocase ascii wide
                        $string219_impacket_offensive_tool_keyword = /\\wmipersist\.exe/ nocase ascii wide
                        $string220_impacket_offensive_tool_keyword = /\\wmipersist\.py/ nocase ascii wide
                        $string221_impacket_offensive_tool_keyword = /\\wmiquery\.py/ nocase ascii wide
                        $string222_impacket_offensive_tool_keyword = /_impacket.{0,100}\.tar\.gz/ nocase ascii wide
                        $string223_impacket_offensive_tool_keyword = "04080e338ffd161caf57ae0c76b1267210fe2c2a68ede32c52d4efca6e38514a" nocase ascii wide
                        $string224_impacket_offensive_tool_keyword = "050720C033870D6BC6D8138D662A3AC0AC5B07858A428C594F81B7B1B55AB963" nocase ascii wide
                        $string225_impacket_offensive_tool_keyword = "05C00EED2E07D2BB64FFC34AA3BA0A8D9F0DE71909ABA35706A074F23285F83B" nocase ascii wide
                        $string226_impacket_offensive_tool_keyword = "10244cbbce7a1608b471e26612dbc9ed658d4dde66f5075d6becb5834df8af8b" nocase ascii wide
                        $string227_impacket_offensive_tool_keyword = "14a2502eebb62133aad519e2717558388f459a4fe281566fbeb0251b0ab2611b" nocase ascii wide
                        $string228_impacket_offensive_tool_keyword = "1917921CEF704F71B692C3EC0D238FE98AF8EF1EE20CACAAD67FBC3BB885EE9A" nocase ascii wide
                        $string229_impacket_offensive_tool_keyword = "1B826591784D6FBFB1BED96065D7EBD9982723D3EEC2386614088AAA4CA84F0D" nocase ascii wide
                        $string230_impacket_offensive_tool_keyword = "1CB9BB2AEE8B6A248427185F165AD3FDDAE8EA923D338C40E93E6F47F1C3F351" nocase ascii wide
                        $string231_impacket_offensive_tool_keyword = "1DCD5A4349F3E617AF53DCFA24600FD169CFDD53DECE33FD72C6D66C2991D240" nocase ascii wide
                        $string232_impacket_offensive_tool_keyword = "25d89bd7da43e326b9bfadeae2c256cf1f06c8522b475d43baecf309b2fa6da7" nocase ascii wide
                        $string233_impacket_offensive_tool_keyword = "26af9c0734525448e4a8d56c9c7b05df0146497ec71101c33812f3f3503201eb" nocase ascii wide
                        $string234_impacket_offensive_tool_keyword = "2D4A23D2A7F25F007CB0B5E17F50B6B84C09560BFB3232B176E74AE4F97B3E89" nocase ascii wide
                        $string235_impacket_offensive_tool_keyword = "379F3514AA07B5A9783639932C3ABF48F68742FE4B65C4A94436632C2AB53AFC" nocase ascii wide
                        $string236_impacket_offensive_tool_keyword = "3979fa127a6e7b52d76b4b92fa2fd3be3d51acfcf109da79ac51ab812cc16098" nocase ascii wide
                        $string237_impacket_offensive_tool_keyword = "3A128F79ABB162476A7677270884213C983E3F07A4850C930C8F9E7BEB38EB50" nocase ascii wide
                        $string238_impacket_offensive_tool_keyword = "404cf0d13d243deeeb2b94b9bf807164376a916377e537604a576e6036f84e9d" nocase ascii wide
                        $string239_impacket_offensive_tool_keyword = "41414141-4141-4141-4141-414141414141" nocase ascii wide
                        $string240_impacket_offensive_tool_keyword = "41a381d6e85d5d47296485417fab7a07c110c98927990415993d75c07f384e3c" nocase ascii wide
                        $string241_impacket_offensive_tool_keyword = "42c6d6eb1e991b9adbdb2ec6563530d9123bd02dbde27e2a547c25d9feb41473" nocase ascii wide
                        $string242_impacket_offensive_tool_keyword = "43ebdb62e179113a55ccd4297316532582be71857b85d85ba187cd6146757397" nocase ascii wide
                        $string243_impacket_offensive_tool_keyword = "44de69934c7cc1b42b995276af916e6a14d8f2170f5de9306ed1e134d8f007de" nocase ascii wide
                        $string244_impacket_offensive_tool_keyword = "450c54e126cbd38523f6dce014bd30bc95ede55141ffc3360b1dd6989895b28f" nocase ascii wide
                        $string245_impacket_offensive_tool_keyword = "455a5ed5b8aca163fd8bbc11a06de8b652517c50a32c634f33a6a093d47e3d4e" nocase ascii wide
                        $string246_impacket_offensive_tool_keyword = "4A5A36539C52FB818E21404B336FC1936B4B5A6AFBB432CD9DB9672F2BAC1B73" nocase ascii wide
                        $string247_impacket_offensive_tool_keyword = "4bf7e7b595356585599b4b2773b8a463d7b9765c97012dcd5a44eb6d547f6a1d" nocase ascii wide
                        $string248_impacket_offensive_tool_keyword = "4C244D2DFBC2E2A8803D3F5522D9F4A788A3A38AF3A37D86D6374A56218D29E9" nocase ascii wide
                        $string249_impacket_offensive_tool_keyword = "4f1fcdf5b4c104fb6585cd73272adc8e31a279dffd5cae84e5e83c685f4830bd" nocase ascii wide
                        $string250_impacket_offensive_tool_keyword = "5499BC48B9E9289A19E8215F3EE3A7003DC2057D13970BFFFC42231A93E690A9" nocase ascii wide
                        $string251_impacket_offensive_tool_keyword = "56bb18010f13a33947c24d31f51e16d8c688cf9c753c1d52f79a9ba64e5c0dca" nocase ascii wide
                        $string252_impacket_offensive_tool_keyword = "5804dab3b58ddd2e4e2a198083e43b3f1759056d33e03d3a26a5c5fc4ce5a5f9" nocase ascii wide
                        $string253_impacket_offensive_tool_keyword = "596481231C2187836E29D3AA4498211393C5A31FB762548D4415673CB9D21797" nocase ascii wide
                        $string254_impacket_offensive_tool_keyword = "5978136ED7A5A34BD587D5D9B7E405560461B166983B94897DF0BD85434653EB" nocase ascii wide
                        $string255_impacket_offensive_tool_keyword = "5ccf7538e23279696252e4ff25a453d2e3693c76d5c2ffce705e8b9b8c1fe1b5" nocase ascii wide
                        $string256_impacket_offensive_tool_keyword = "5CF031648822442C641F601094E922898DFA3D93C8D0B3E44FBCE22F43E7E402" nocase ascii wide
                        $string257_impacket_offensive_tool_keyword = "5f8c475f1a4772644bbae8e3a31e11e78b7f44a1559f5e6bb58b7b3b9083323d" nocase ascii wide
                        $string258_impacket_offensive_tool_keyword = "65E26974FA14B95E42DE9662308EAC9042E06DD5FDC0987BC1D73FEF2ED2F4FD" nocase ascii wide
                        $string259_impacket_offensive_tool_keyword = "66924A72494CDBBE223AE81A49AAA2A47DAD741CBC5D180FA85C66ACE641DC35" nocase ascii wide
                        $string260_impacket_offensive_tool_keyword = "6844B720CFF6E079879333D6FDA944D3D3EA78878B48AFFD45AC81700BBA0F5E" nocase ascii wide
                        $string261_impacket_offensive_tool_keyword = "6eab9e77c73f2eedae88d1b7cc7b7f2b5f23dc5c7a6110a50a1167ccfcb53769" nocase ascii wide
                        $string262_impacket_offensive_tool_keyword = "7133a7bae7094a163a75a072f6859a89b54326a111b86af5084fb88206bb89a1" nocase ascii wide
                        $string263_impacket_offensive_tool_keyword = "723D2DE5B3168EE39FAADD70DCCE691FAE5968D446B8CF47AEA7B29782C02D77" nocase ascii wide
                        $string264_impacket_offensive_tool_keyword = "7794d2cb665c264f4cda6652c30e727965a5f5ea10e258df5d00d9765ee24910" nocase ascii wide
                        $string265_impacket_offensive_tool_keyword = "78a28021014c880da7336b529ed813f42c4a79fdc86d8ad38a579744abfcb71b" nocase ascii wide
                        $string266_impacket_offensive_tool_keyword = "7a4f5e4e4a422a58994593c27fc6e9772072ad573ff22483f1b6913f9bbe70ad" nocase ascii wide
                        $string267_impacket_offensive_tool_keyword = "7c60f8bb63b494964ea495a4ccdfd5a5370c2b9317f26c8bfa1d4070cc4cebe4" nocase ascii wide
                        $string268_impacket_offensive_tool_keyword = "7DB2951389A8839D1CC00088A7A2C2432B396D742CABEEC317C02C7B8564250D" nocase ascii wide
                        $string269_impacket_offensive_tool_keyword = "8248D38639F4808913BB926B20C9AB1B31908BCE8C3A564FF496A8883DE01C97" nocase ascii wide
                        $string270_impacket_offensive_tool_keyword = "831d70eff6225d3ca5ed5723f7d17c5b7f7f7aaad583e6b0a7d8dd99cdcde755" nocase ascii wide
                        $string271_impacket_offensive_tool_keyword = "8c866a47872113274363ad6f3ca399d6e3cb45b99ce5e47a579ef1eb31fb0bcf" nocase ascii wide
                        $string272_impacket_offensive_tool_keyword = "8e71740b1b1dd564dc2c05bb1e355baef9d0ab9bb14fafd91df60ba0998af866" nocase ascii wide
                        $string273_impacket_offensive_tool_keyword = "8EE4FF2A394B4683DA7E1BCB76010F184A587BFBF41E2853CE4E007ABDD9B75E" nocase ascii wide
                        $string274_impacket_offensive_tool_keyword = "8F6EB0768AB3620A60AC80E9A1E14F83BD7332E8AFC00092FD4768C8686DA87E" nocase ascii wide
                        $string275_impacket_offensive_tool_keyword = "904A001AD82F09CD0CB1E1945B29F9120BEB603F7D116BD27A18E6A74DB6B53A" nocase ascii wide
                        $string276_impacket_offensive_tool_keyword = "912f812564e87c31a162cfe0626f3a6cbc5b6864deedbfefc31f6d321859ade3" nocase ascii wide
                        $string277_impacket_offensive_tool_keyword = "959818e89008c47a0f515ac6f000163c9ff6a9a0cc094d42d1a823ab3f461d22" nocase ascii wide
                        $string278_impacket_offensive_tool_keyword = "963119C10E2DC7140A57BCD3456279C5AB4E9E2A3415F91E93BB5F8D8239D996" nocase ascii wide
                        $string279_impacket_offensive_tool_keyword = "9C2282F1A49F43F1F541DD57C539C6B73D59E8924382B96B23881B85AC333928" nocase ascii wide
                        $string280_impacket_offensive_tool_keyword = "9d28971b2a831336162f0d303cc1c7400e5876a968f2c6553b46c852ee121504" nocase ascii wide
                        $string281_impacket_offensive_tool_keyword = "9d3244ba1396ef5d4f5ee375dfa00971f5e6ed20aa2705c570497c78b9948ea8" nocase ascii wide
                        $string282_impacket_offensive_tool_keyword = "9dbb7cd0d0bc25a9ead8ef4a6b2635c503a4b1f60b62490abf0a068b1108ebff" nocase ascii wide
                        $string283_impacket_offensive_tool_keyword = "9ECA7D150BA4BF6458ECA88EC6083DDEE2113202C68D07F6E7BC521333D0CE10" nocase ascii wide
                        $string284_impacket_offensive_tool_keyword = "9EDF1E70CDCE89E9AE400305C24CD202EC348D38E464F61180D509C5AF569CB3" nocase ascii wide
                        $string285_impacket_offensive_tool_keyword = "9FF259F26CA9D841AFD5D6AF5B631F6CB267ED602BC50624830DC47EF743483E" nocase ascii wide
                        $string286_impacket_offensive_tool_keyword = "a836426cb1693f3d72b455ae5ff8315993ea5217047bfca288b56554d717f632" nocase ascii wide
                        $string287_impacket_offensive_tool_keyword = "A99F07FBB9AD4C798BBF570E4C3FEA33AB95E10479F204BE18041EC07BD8CFFF" nocase ascii wide
                        $string288_impacket_offensive_tool_keyword = "A9A26EE65BEDB50FD71BF89819EFFBF42E06D40525928F125A161B6395CECB52" nocase ascii wide
                        $string289_impacket_offensive_tool_keyword = "ab99bbfa0e8addfa9f389a05138f21c9976a07a984c74ea0066c6c2aefe2afde" nocase ascii wide
                        $string290_impacket_offensive_tool_keyword = /adcsattack\.py/ nocase ascii wide
                        $string291_impacket_offensive_tool_keyword = /addcomputer\.py/ nocase ascii wide
                        $string292_impacket_offensive_tool_keyword = /admin\.kirbi/ nocase ascii wide
                        $string293_impacket_offensive_tool_keyword = /atexec\.py/ nocase ascii wide
                        $string294_impacket_offensive_tool_keyword = "b8eb020a2cbb47146669cfe31c64bb2e7d6499d049c493d6418b9716f5c74583" nocase ascii wide
                        $string295_impacket_offensive_tool_keyword = "b9de1ac4e68a0c4be90109880892b3b34a296d02102d94f1f79913fcd4806922" nocase ascii wide
                        $string296_impacket_offensive_tool_keyword = /c\:\\__output/ nocase ascii wide
                        $string297_impacket_offensive_tool_keyword = "C1E1BD733564A70F30B59BC7B8067BF47512D70D71C15B18F49B5BEC2891CB44" nocase ascii wide
                        $string298_impacket_offensive_tool_keyword = /cat\s.{0,100}\.ntds/ nocase ascii wide
                        $string299_impacket_offensive_tool_keyword = /changepasswd\.py/ nocase ascii wide
                        $string300_impacket_offensive_tool_keyword = /cmd\.exe\s\/C\stasklist\s\/m\s\>\sC\:\\Windows\\Temp\\.{0,100}\.tmp\s2\>\&1/ nocase ascii wide
                        $string301_impacket_offensive_tool_keyword = /cmd\.exe\s\/Q\s\/c\s.{0,100}\s1\>\s.{0,100}\\\\127\.0\.0\.1\\ADMIN\$\\__.{0,100}\s2\>\&1/ nocase ascii wide
                        $string302_impacket_offensive_tool_keyword = /cmd\.exe\s\/Q\s\/c\scd\s\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\_.{0,100}\>\&1/ nocase ascii wide
                        $string303_impacket_offensive_tool_keyword = /cmd\.exe\s\/Q\s\/c\scd\s\\\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\__.{0,100}\s2\>\&1/ nocase ascii wide
                        $string304_impacket_offensive_tool_keyword = /cmd\.exe\s\/Q\s\/c\secho\stasklist\s\^\>\s\\\\127\.0\.0\.1\\C\$\\__.{0,100}2\^\>\^\&1\s\>\s/ nocase ascii wide
                        $string305_impacket_offensive_tool_keyword = /cmd\.exe\s\/Q\s\/c\swhoami\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\_.{0,100}2\>\&1/ nocase ascii wide
                        $string306_impacket_offensive_tool_keyword = /cmd\.exe\\"\s\/C\stasklist\s\/m\s\>\sC\:\\Windows\\Temp\\.{0,100}\.tmp\s2\>\&1/ nocase ascii wide
                        $string307_impacket_offensive_tool_keyword = /cmd\.exe\\"\s\/Q\s\/c\scd\s\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\_.{0,100}\>\&1/ nocase ascii wide
                        $string308_impacket_offensive_tool_keyword = /cmd\.exe\\"\s\/Q\s\/c\scd\s\\\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\__.{0,100}\s2\>\&1/ nocase ascii wide
                        $string309_impacket_offensive_tool_keyword = /cmd\.exe\\"\s\/Q\s\/c\swhoami\s1\>\s\\\\127\.0\.0\.1\\ADMIN\$\\_.{0,100}2\>\&1/ nocase ascii wide
                        $string310_impacket_offensive_tool_keyword = /cmd\:who\s\|\snc\s\-u\s/ nocase ascii wide
                        $string311_impacket_offensive_tool_keyword = "convert_ccache_to_kirbi" nocase ascii wide
                        $string312_impacket_offensive_tool_keyword = "convert_kirbi_to_ccache" nocase ascii wide
                        $string313_impacket_offensive_tool_keyword = "D52008450F6AD0DBB4C8E5596B97A322DAC76CC6A59C9D0CB1AF26D09CC2E013" nocase ascii wide
                        $string314_impacket_offensive_tool_keyword = "db7c237e7fe7b5bed6b1d63082f21810eb2f0defdf2663de2e7871bb6f24472d" nocase ascii wide
                        $string315_impacket_offensive_tool_keyword = "db8b7152534b483ed966cd9557bed083106b448feea5e06d6963c0bd7b282f40" nocase ascii wide
                        $string316_impacket_offensive_tool_keyword = /dcomexec\.py/ nocase ascii wide
                        $string317_impacket_offensive_tool_keyword = /dcsyncattack\.py/ nocase ascii wide
                        $string318_impacket_offensive_tool_keyword = /dcsyncclient\.py/ nocase ascii wide
                        $string319_impacket_offensive_tool_keyword = "DD5BAEEE88AA8F4EF1A0421214C5D42F28786C84C8A4C3C3C3C8897F553D9347" nocase ascii wide
                        $string320_impacket_offensive_tool_keyword = /dpapi\.py/ nocase ascii wide
                        $string321_impacket_offensive_tool_keyword = /DumpNTLMInfo\.py/ nocase ascii wide
                        $string322_impacket_offensive_tool_keyword = "E2778331DA361353B5A445FBD4488418BD25F19FBB931AB39FD9E005137153E8" nocase ascii wide
                        $string323_impacket_offensive_tool_keyword = "E2E5C254A2E4BDC4926B6CAD49F0F0FE3933B436DE232C85C900C41A16888F55" nocase ascii wide
                        $string324_impacket_offensive_tool_keyword = "E300339058A885475F5952FB4E9FAAA09BB6EAC26757443017B281C46B03108B" nocase ascii wide
                        $string325_impacket_offensive_tool_keyword = "e58b8ccccb9d997328877f89fa748bc62b4c4b29945abd2a1d8d60b55a84811a" nocase ascii wide
                        $string326_impacket_offensive_tool_keyword = "e97d6c8f6d2fc73bceefac93fdfa2c4724a68e58b26e4c2631e78580f2722d2a" nocase ascii wide
                        $string327_impacket_offensive_tool_keyword = "e97d6c8f6d2fc73bceefac93fdfa2c4724a68e58b26e4c2631e78580f2722d2a" nocase ascii wide
                        $string328_impacket_offensive_tool_keyword = "ee27cb1d6e87e293f1fa91adb5870328890990e941d1fabe5cb4565fb4795a21" nocase ascii wide
                        $string329_impacket_offensive_tool_keyword = "ee4039b4d2aede8f5f64478bc59faac86036796be24dea8dc18f009fb0905e4a" nocase ascii wide
                        $string330_impacket_offensive_tool_keyword = /examples\/netview\.py/ nocase ascii wide
                        $string331_impacket_offensive_tool_keyword = "f1ddf8432a3f2db1ab2b679abaeaccd61fc601cf2e45cf0f95d169759bc6eaf2" nocase ascii wide
                        $string332_impacket_offensive_tool_keyword = "F2BA8C8961B3624BDB06DA8025CE8BB39B0375CA78CB4E52FE0259613FE6CEBD" nocase ascii wide
                        $string333_impacket_offensive_tool_keyword = "f4257657ae5bf141b31cd56db96ac003687be4eb404d1245e27256307e0b5d35" nocase ascii wide
                        $string334_impacket_offensive_tool_keyword = "FC94F7F1F60026351DF16E3F9681E37BAA7491694DD7C5EA2CBE4B4F62602963" nocase ascii wide
                        $string335_impacket_offensive_tool_keyword = "FF3347B5A5D4392C5B9D571E9A52DEEE018BEFE78D67A0F096CB995BCA7B1186" nocase ascii wide
                        $string336_impacket_offensive_tool_keyword = /findDelegation\.py/ nocase ascii wide
                        $string337_impacket_offensive_tool_keyword = "-force-forwardableet-ADComputer" nocase ascii wide
                        $string338_impacket_offensive_tool_keyword = "fortra/impacket" nocase ascii wide
                        $string339_impacket_offensive_tool_keyword = /FrameManagementAssociationRequest\.py/ nocase ascii wide
                        $string340_impacket_offensive_tool_keyword = /FrameManagementDeauthentication\.py/ nocase ascii wide
                        $string341_impacket_offensive_tool_keyword = /FrameManagementProbeRequest\.py/ nocase ascii wide
                        $string342_impacket_offensive_tool_keyword = /FrameManagementReassociationResponse\.py/ nocase ascii wide
                        $string343_impacket_offensive_tool_keyword = /from\s\.ccache\simport\sCcache/ nocase ascii wide
                        $string344_impacket_offensive_tool_keyword = /from\simpacket\./ nocase ascii wide
                        $string345_impacket_offensive_tool_keyword = /GetADUsers\.py/ nocase ascii wide
                        $string346_impacket_offensive_tool_keyword = /Get\-GPPPassword\.py/ nocase ascii wide
                        $string347_impacket_offensive_tool_keyword = /GetNPUsers\.py/ nocase ascii wide
                        $string348_impacket_offensive_tool_keyword = /getPac\.py/ nocase ascii wide
                        $string349_impacket_offensive_tool_keyword = /getTGT\.py/ nocase ascii wide
                        $string350_impacket_offensive_tool_keyword = /GetUserSPNs\./ nocase ascii wide
                        $string351_impacket_offensive_tool_keyword = /goldenPac\.py/ nocase ascii wide
                        $string352_impacket_offensive_tool_keyword = /http\:\/\/127\.0\.0\.1\:9090\// nocase ascii wide
                        $string353_impacket_offensive_tool_keyword = "http://localhost:9090/" nocase ascii wide
                        $string354_impacket_offensive_tool_keyword = /httpattack\.py/ nocase ascii wide
                        $string355_impacket_offensive_tool_keyword = /httpattacks\/.{0,100}\.py/ nocase ascii wide
                        $string356_impacket_offensive_tool_keyword = /httprelayclient\.py/ nocase ascii wide
                        $string357_impacket_offensive_tool_keyword = /httprelayserver\.py/ nocase ascii wide
                        $string358_impacket_offensive_tool_keyword = /imapattack\.py/ nocase ascii wide
                        $string359_impacket_offensive_tool_keyword = /imaprelayclient\.py/ nocase ascii wide
                        $string360_impacket_offensive_tool_keyword = "impacket" nocase ascii wide
                        $string361_impacket_offensive_tool_keyword = "impacket" nocase ascii wide
                        $string362_impacket_offensive_tool_keyword = /impacket\-.{0,100}\s/ nocase ascii wide
                        $string363_impacket_offensive_tool_keyword = /impacket\-.{0,100}\.tar\.gz/ nocase ascii wide
                        $string364_impacket_offensive_tool_keyword = /\'impacket\./ nocase ascii wide
                        $string365_impacket_offensive_tool_keyword = /impacket\.git/ nocase ascii wide
                        $string366_impacket_offensive_tool_keyword = /impacket\.ImpactPacket/ nocase ascii wide
                        $string367_impacket_offensive_tool_keyword = /impacket\.krb5\.asn1/ nocase ascii wide
                        $string368_impacket_offensive_tool_keyword = /impacket\.krb5\.ccache/ nocase ascii wide
                        $string369_impacket_offensive_tool_keyword = /impacket\.krb5\.kerberosv5/ nocase ascii wide
                        $string370_impacket_offensive_tool_keyword = /impacket\.ldap/ nocase ascii wide
                        $string371_impacket_offensive_tool_keyword = /impacket\.msada_guids/ nocase ascii wide
                        $string372_impacket_offensive_tool_keyword = /impacket\.ntlm/ nocase ascii wide
                        $string373_impacket_offensive_tool_keyword = /impacket\/.{0,100}\.py/ nocase ascii wide
                        $string374_impacket_offensive_tool_keyword = "impacket:latest" nocase ascii wide
                        $string375_impacket_offensive_tool_keyword = "impacket:latest" nocase ascii wide
                        $string376_impacket_offensive_tool_keyword = "impacket__init__" nocase ascii wide
                        $string377_impacket_offensive_tool_keyword = "impacket-atexec" nocase ascii wide
                        $string378_impacket_offensive_tool_keyword = "impacket-dcomexec" nocase ascii wide
                        $string379_impacket_offensive_tool_keyword = "impacket-GetADUsers" nocase ascii wide
                        $string380_impacket_offensive_tool_keyword = "impacket-GetNPUsers" nocase ascii wide
                        $string381_impacket_offensive_tool_keyword = "impacket-getST" nocase ascii wide
                        $string382_impacket_offensive_tool_keyword = "impacket-getTGT" nocase ascii wide
                        $string383_impacket_offensive_tool_keyword = "impacketldap_shell" nocase ascii wide
                        $string384_impacket_offensive_tool_keyword = "impacketlogger" nocase ascii wide
                        $string385_impacket_offensive_tool_keyword = "impacket-lookupsid" nocase ascii wide
                        $string386_impacket_offensive_tool_keyword = "impacketmssqlshell" nocase ascii wide
                        $string387_impacket_offensive_tool_keyword = "impacket-netview" nocase ascii wide
                        $string388_impacket_offensive_tool_keyword = "impacketntlmrelayx" nocase ascii wide
                        $string389_impacket_offensive_tool_keyword = "impacketos_ident" nocase ascii wide
                        $string390_impacket_offensive_tool_keyword = "impacket-psexec" nocase ascii wide
                        $string391_impacket_offensive_tool_keyword = "impacket-reg" nocase ascii wide
                        $string392_impacket_offensive_tool_keyword = "impacket-reg" nocase ascii wide
                        $string393_impacket_offensive_tool_keyword = "impacketremcomsvc" nocase ascii wide
                        $string394_impacket_offensive_tool_keyword = "impacketrpcdatabase" nocase ascii wide
                        $string395_impacket_offensive_tool_keyword = "impacket-rpcdump" nocase ascii wide
                        $string396_impacket_offensive_tool_keyword = "impacket-samrdump" nocase ascii wide
                        $string397_impacket_offensive_tool_keyword = "impacketsecretsdump" nocase ascii wide
                        $string398_impacket_offensive_tool_keyword = "impacket-secretsdump" nocase ascii wide
                        $string399_impacket_offensive_tool_keyword = "impacket-secretsdump" nocase ascii wide
                        $string400_impacket_offensive_tool_keyword = "impacketserviceinstall" nocase ascii wide
                        $string401_impacket_offensive_tool_keyword = "impacket-services" nocase ascii wide
                        $string402_impacket_offensive_tool_keyword = "impacketsmbclient" nocase ascii wide
                        $string403_impacket_offensive_tool_keyword = "impacket-smbclient" nocase ascii wide
                        $string404_impacket_offensive_tool_keyword = "impacket-smbserver" nocase ascii wide
                        $string405_impacket_offensive_tool_keyword = "impacket-ticketer" nocase ascii wide
                        $string406_impacket_offensive_tool_keyword = "impacketutils" nocase ascii wide
                        $string407_impacket_offensive_tool_keyword = "impacket-wmiexec" nocase ascii wide
                        $string408_impacket_offensive_tool_keyword = "ImpactDecoder" nocase ascii wide
                        $string409_impacket_offensive_tool_keyword = "ImpactPacket" nocase ascii wide
                        $string410_impacket_offensive_tool_keyword = "import impacket" nocase ascii wide
                        $string411_impacket_offensive_tool_keyword = "is_kirbi_file" nocase ascii wide
                        $string412_impacket_offensive_tool_keyword = /karmaSMB\.py/ nocase ascii wide
                        $string413_impacket_offensive_tool_keyword = /kerberos\-ldap\-password\-hunter\.sh/ nocase ascii wide
                        $string414_impacket_offensive_tool_keyword = /kerberosv5\.py/ nocase ascii wide
                        $string415_impacket_offensive_tool_keyword = /keylistattack\.py/ nocase ascii wide
                        $string416_impacket_offensive_tool_keyword = /kintercept\.py/ nocase ascii wide
                        $string417_impacket_offensive_tool_keyword = /kintercept\.py/ nocase ascii wide
                        $string418_impacket_offensive_tool_keyword = "krbrelayx" nocase ascii wide
                        $string419_impacket_offensive_tool_keyword = /ldapasn1\.py/ nocase ascii wide
                        $string420_impacket_offensive_tool_keyword = /ldapattack\.py/ nocase ascii wide
                        $string421_impacket_offensive_tool_keyword = "LDAP-Password-Hunter" nocase ascii wide
                        $string422_impacket_offensive_tool_keyword = /ldaprelayclient\.py/ nocase ascii wide
                        $string423_impacket_offensive_tool_keyword = "loadKirbiFile" nocase ascii wide
                        $string424_impacket_offensive_tool_keyword = /lookupsid\.py/ nocase ascii wide
                        $string425_impacket_offensive_tool_keyword = /mimikatz\.py/ nocase ascii wide
                        $string426_impacket_offensive_tool_keyword = /mimilib\.py/ nocase ascii wide
                        $string427_impacket_offensive_tool_keyword = /mqtt_check\.py/ nocase ascii wide
                        $string428_impacket_offensive_tool_keyword = /mssqlattack\.py/ nocase ascii wide
                        $string429_impacket_offensive_tool_keyword = /mssqlrelayclient\./ nocase ascii wide
                        $string430_impacket_offensive_tool_keyword = /ndDelegation\.py/ nocase ascii wide
                        $string431_impacket_offensive_tool_keyword = /netview\.py/ nocase ascii wide
                        $string432_impacket_offensive_tool_keyword = /nmapAnswerMachine\.py/ nocase ascii wide
                        $string433_impacket_offensive_tool_keyword = /ntfs\-read\.py/ nocase ascii wide
                        $string434_impacket_offensive_tool_keyword = /ntlm\.py\s/ nocase ascii wide
                        $string435_impacket_offensive_tool_keyword = /ntlmrelayx\./ nocase ascii wide
                        $string436_impacket_offensive_tool_keyword = /ntlmrelayx\.exe/ nocase ascii wide
                        $string437_impacket_offensive_tool_keyword = /ntlmrelayx\.py_to_exe/ nocase ascii wide
                        $string438_impacket_offensive_tool_keyword = /ntlmrelayx_original\.py/ nocase ascii wide
                        $string439_impacket_offensive_tool_keyword = "package=impacket" nocase ascii wide
                        $string440_impacket_offensive_tool_keyword = /pcap_linktypes\.py/ nocase ascii wide
                        $string441_impacket_offensive_tool_keyword = /pcapfile\.py/ nocase ascii wide
                        $string442_impacket_offensive_tool_keyword = "Permits to backup a DACL before a modification" nocase ascii wide
                        $string443_impacket_offensive_tool_keyword = "pip install impacket" nocase ascii wide
                        $string444_impacket_offensive_tool_keyword = /powershell\.exe\s\-NoP\s\-NoL\s\-sta\s\-NonI\s\-W\sHidden\s\-Exec\sBypass\s\-Enc\s/ nocase ascii wide
                        $string445_impacket_offensive_tool_keyword = /psexec\.py/ nocase ascii wide
                        $string446_impacket_offensive_tool_keyword = /raiseChild\.py/ nocase ascii wide
                        $string447_impacket_offensive_tool_keyword = /rawrelayserver\.py/ nocase ascii wide
                        $string448_impacket_offensive_tool_keyword = /rbcd\.py/ nocase ascii wide
                        $string449_impacket_offensive_tool_keyword = /rdp_check\.py/ nocase ascii wide
                        $string450_impacket_offensive_tool_keyword = /registry\-read\.py/ nocase ascii wide
                        $string451_impacket_offensive_tool_keyword = /relay.{0,100}\/utils\/enum\.py/ nocase ascii wide
                        $string452_impacket_offensive_tool_keyword = /rpcattack\.py/ nocase ascii wide
                        $string453_impacket_offensive_tool_keyword = /rpcdump\.py/ nocase ascii wide
                        $string454_impacket_offensive_tool_keyword = /rpcmap\.py/ nocase ascii wide
                        $string455_impacket_offensive_tool_keyword = /rpcrelayclient\./ nocase ascii wide
                        $string456_impacket_offensive_tool_keyword = /sambaPipe\.py/ nocase ascii wide
                        $string457_impacket_offensive_tool_keyword = /samrdump\.py/ nocase ascii wide
                        $string458_impacket_offensive_tool_keyword = /secretsdump\.py/ nocase ascii wide
                        $string459_impacket_offensive_tool_keyword = /secretsdump\.py/ nocase ascii wide
                        $string460_impacket_offensive_tool_keyword = /secretsdump\.py/ nocase ascii wide
                        $string461_impacket_offensive_tool_keyword = /smbattack\.py/ nocase ascii wide
                        $string462_impacket_offensive_tool_keyword = /smbexec\.py/ nocase ascii wide
                        $string463_impacket_offensive_tool_keyword = /smbpasswd\.py/ nocase ascii wide
                        $string464_impacket_offensive_tool_keyword = /smbrelayclient\.py/ nocase ascii wide
                        $string465_impacket_offensive_tool_keyword = /smbrelayserver\.py/ nocase ascii wide
                        $string466_impacket_offensive_tool_keyword = /smbrelayx\.py/ nocase ascii wide
                        $string467_impacket_offensive_tool_keyword = /smbserver\.py/ nocase ascii wide
                        $string468_impacket_offensive_tool_keyword = /smtprelayclient\.py/ nocase ascii wide
                        $string469_impacket_offensive_tool_keyword = /sniffer\.py/ nocase ascii wide
                        $string470_impacket_offensive_tool_keyword = /tcpshell\.py/ nocase ascii wide
                        $string471_impacket_offensive_tool_keyword = "test_ccache_fromKirbi" nocase ascii wide
                        $string472_impacket_offensive_tool_keyword = /ticketConverter\.py/ nocase ascii wide
                        $string473_impacket_offensive_tool_keyword = /ticketer\.py/ nocase ascii wide
                        $string474_impacket_offensive_tool_keyword = /wcfrelayserver\.py/ nocase ascii wide
                        $string475_impacket_offensive_tool_keyword = /winregistry\.py/ nocase ascii wide
                        $string476_impacket_offensive_tool_keyword = /wmipersist\.py/ nocase ascii wide
        $metadata_regex_import = /\bimport\s+[a-zA-Z0-9_.]+\b/ nocase
        $metadata_regex_function = /function\s+[a-zA-Z_][a-zA-Z0-9_]*\(/ nocase ascii
        $metadata_regex_php = /<\?php/ nocase ascii
        $metadata_regex_createobject = /(CreateObject|WScript\.)/ nocase ascii
        $metadata_regex_script = /<script\b/ nocase ascii
        $metadata_regex_javascript = /(let\s|const\s|function\s|document\.|console\.)/ nocase ascii
        $metadata_regex_powershell = /(Write-Host|Get-[a-zA-Z]+|Invoke-|param\(|\.SYNOPSIS)/ nocase ascii
        $metadata_regex_batch = /@(echo\s|call\s|set\s|goto\s|if\s|for\s|rem\s)/ nocase ascii
        $metadata_regex_shebang = /^#!\// nocase ascii

    condition:
        ((filesize < 20MB and (
            uint16(0) == 0x5a4d or             uint16(0) == 0x457f or             uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or             uint32(0) == 0x504B0304 or             uint32(0) == 0xCAFEBABE or             uint32(0) == 0x4D534346 or             uint32(0) == 0xD0CF11E0 or             uint16(0) == 0x2321 or             uint16(0) == 0x3c3f         )) and 2 of ($string*)) or
        (filesize < 2MB and
        (
            2 of ($string*) and
            for any of ($metadata_regex_*) : ( @ <= 20000 )
        ))
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ae1d26e0-9d71-4aef-93ec-e7e3adb92160
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
