rule_linWinPwn_offensive_tool_keyword
YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'linWinPwn' taken from the ThreatHunting-Keywords github project
rule rule_linWinPwn_offensive_tool_keyword
{
meta:
description = "Detection patterns for the tool 'linWinPwn' taken from the ThreatHunting-Keywords github project"
author = "@mthcht"
reference = "https://github.com/mthcht/ThreatHunting-Keywords"
tool = "linWinPwn"
rule_category = "offensive_tool_keyword"
strings:
$string1_linWinPwn_offensive_tool_keyword = " aad3b435b51404eeaad3b435b51404ee"
$string2_linWinPwn_offensive_tool_keyword = " --asreproast "
$string3_linWinPwn_offensive_tool_keyword = /\scoerce\s.{0,100}\s\-\-dc\-ip\s/
$string4_linWinPwn_offensive_tool_keyword = /\s\-\-dc\s.{0,100}\s\-m\scustom\s\-\-filter\s.{0,100}objectCategory/
$string5_linWinPwn_offensive_tool_keyword = /\s\-dc\-ip\s.{0,100}\s\-dump\s/
$string6_linWinPwn_offensive_tool_keyword = /\s\-\-dc\-ip\s.{0,100}\s\-\-vuln\s\-\-enabled/
$string7_linWinPwn_offensive_tool_keyword = /\s\-dc\-ip\s.{0,100}SAMDump/
$string8_linWinPwn_offensive_tool_keyword = " --force-kerb "
$string9_linWinPwn_offensive_tool_keyword = /\s\-\-format\=krb5asrep.{0,100}\s\-\-wordlist\=/
$string10_linWinPwn_offensive_tool_keyword = " -g -n --kerberoast"
$string11_linWinPwn_offensive_tool_keyword = " --impersonate Administrator -shell "
$string12_linWinPwn_offensive_tool_keyword = /\s\-ip\s.{0,100}\s\-smb2support\s.{0,100}lwpshare.{0,100}\s/
$string13_linWinPwn_offensive_tool_keyword = /\sldap\s.{0,100}\s\-\-gmsa\s.{0,100}dump/
$string14_linWinPwn_offensive_tool_keyword = " linWinPwn"
$string15_linWinPwn_offensive_tool_keyword = " -M dfscoerce "
$string16_linWinPwn_offensive_tool_keyword = " -M handlekatz "
$string17_linWinPwn_offensive_tool_keyword = " -M keepass_discover "
$string18_linWinPwn_offensive_tool_keyword = " -M laps --kdcHost "
$string19_linWinPwn_offensive_tool_keyword = " -M ldap-checker "
$string20_linWinPwn_offensive_tool_keyword = " -M lsassy "
$string21_linWinPwn_offensive_tool_keyword = " -M MAQ --kdcHost "
$string22_linWinPwn_offensive_tool_keyword = /\s\-M\smasky\s.{0,100}CA\=/
$string23_linWinPwn_offensive_tool_keyword = " -M ms17-010 "
$string24_linWinPwn_offensive_tool_keyword = " -M mssql_priv "
$string25_linWinPwn_offensive_tool_keyword = " -M nanodump "
$string26_linWinPwn_offensive_tool_keyword = " -M petitpotam "
$string27_linWinPwn_offensive_tool_keyword = " -M printnightmare "
$string28_linWinPwn_offensive_tool_keyword = " -m privileged-users --full "
$string29_linWinPwn_offensive_tool_keyword = " -M procdump "
$string30_linWinPwn_offensive_tool_keyword = " -M runasppl "
$string31_linWinPwn_offensive_tool_keyword = " -M shadowcoerce "
$string32_linWinPwn_offensive_tool_keyword = " -M spider_plus "
$string33_linWinPwn_offensive_tool_keyword = " -M teams_localdb "
$string34_linWinPwn_offensive_tool_keyword = " -M zerologon "
$string35_linWinPwn_offensive_tool_keyword = " -no-pass -just-dc-user "
$string36_linWinPwn_offensive_tool_keyword = /\s\-no\-preauth\s.{0,100}\s\-dc\-ip\s/
$string37_linWinPwn_offensive_tool_keyword = " --only-abuse --dc-host "
$string38_linWinPwn_offensive_tool_keyword = /\s\-\-password\-not\-required\s\-\-kdcHost\s.{0,100}cme/
$string39_linWinPwn_offensive_tool_keyword = /\s\-pfx\s.{0,100}\.pfx\s\-dc\-ip\s/
$string40_linWinPwn_offensive_tool_keyword = " -request -dc-ip "
$string41_linWinPwn_offensive_tool_keyword = /\s\-\-rid\-brute\s2\>\&1\s.{0,100}\.txt/
$string42_linWinPwn_offensive_tool_keyword = " -save-old -dc-ip "
$string43_linWinPwn_offensive_tool_keyword = /\sscan\s.{0,100}\s\-\-dc\-ip\s/
$string44_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,100}\s\-\-dpapi\s.{0,100}password/
$string45_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,100}\s\-\-gen\-relay\-list\s.{0,100}\.txt/
$string46_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,100}\s\-\-lsa\s\-\-log\s/
$string47_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,100}\s\-M\smsol\s/
$string48_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,100}\s\-M\sntlmv1\s/
$string49_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,100}\s\-\-ntds\s\-\-log\s/
$string50_linWinPwn_offensive_tool_keyword = /\ssmb\s.{0,100}\s\-\-sam\s\-\-log\s/
$string51_linWinPwn_offensive_tool_keyword = /\suserenum\s.{0,100}\s\-\-dc\s/
$string52_linWinPwn_offensive_tool_keyword = " -vulnerable -stdout -hide-admins"
$string53_linWinPwn_offensive_tool_keyword = /\$attacker_IPlist/
$string54_linWinPwn_offensive_tool_keyword = /\/asreproast_hashes_.{0,100}\.txt/
$string55_linWinPwn_offensive_tool_keyword = /\/cme_adcs_output_.{0,100}\.txt/
$string56_linWinPwn_offensive_tool_keyword = "/cme_shares_output_"
$string57_linWinPwn_offensive_tool_keyword = "/cme_spooler_output_"
$string58_linWinPwn_offensive_tool_keyword = /\/coercer_output_.{0,100}\.txt/
$string59_linWinPwn_offensive_tool_keyword = /\/Credentials\/.{0,100}\.ccache/
$string60_linWinPwn_offensive_tool_keyword = /\/Credentials\/firefox_.{0,100}\.txt/
$string61_linWinPwn_offensive_tool_keyword = /\/Credentials\/msol_.{0,100}\.txt/
$string62_linWinPwn_offensive_tool_keyword = /\/dcsync_.{0,100}\.txt/
$string63_linWinPwn_offensive_tool_keyword = /\/DomainRecon\/.{0,100}\.txt/
$string64_linWinPwn_offensive_tool_keyword = /\/gMSA_dump_.{0,100}\.txt/
$string65_linWinPwn_offensive_tool_keyword = /\/keepass_discover_.{0,100}\.txt/
$string66_linWinPwn_offensive_tool_keyword = /\/kerberoast_hashes_.{0,100}\.txt/
$string67_linWinPwn_offensive_tool_keyword = /\/laps_dump_.{0,100}\.txt/
$string68_linWinPwn_offensive_tool_keyword = "/ldeepDump"
$string69_linWinPwn_offensive_tool_keyword = "/linWinPwn"
$string70_linWinPwn_offensive_tool_keyword = /\/lsa_dump_.{0,100}\.txt/
$string71_linWinPwn_offensive_tool_keyword = /\/manspider_output.{0,100}\.txt/
$string72_linWinPwn_offensive_tool_keyword = "/manspiderDump"
$string73_linWinPwn_offensive_tool_keyword = /\/nmap_smb_scan_all_.{0,100}\.txt/
$string74_linWinPwn_offensive_tool_keyword = /\/ntds_dump_.{0,100}\.txt/
$string75_linWinPwn_offensive_tool_keyword = "/opt/lwp-scripts"
$string76_linWinPwn_offensive_tool_keyword = "/opt/lwp-wordlists"
$string77_linWinPwn_offensive_tool_keyword = /\/rockyou\.txt/
$string78_linWinPwn_offensive_tool_keyword = /\/sam_dump_.{0,100}\.txt/
$string79_linWinPwn_offensive_tool_keyword = /\/Scans\/servers_all_smb.{0,100}\.txt/
$string80_linWinPwn_offensive_tool_keyword = /\/secretsdump_.{0,100}\.txt/
$string81_linWinPwn_offensive_tool_keyword = "/smbmapDump"
$string82_linWinPwn_offensive_tool_keyword = /\/windapsearch_.{0,100}\.txt/
$string83_linWinPwn_offensive_tool_keyword = "asrep_attack"
$string84_linWinPwn_offensive_tool_keyword = "asreprc4_attack"
$string85_linWinPwn_offensive_tool_keyword = "asreproast_john_results_"
$string86_linWinPwn_offensive_tool_keyword = /asreproast_output_.{0,100}\.txt/
$string87_linWinPwn_offensive_tool_keyword = "bhd_enum_dconly"
$string88_linWinPwn_offensive_tool_keyword = /bloodhound_output.{0,100}\/dev\/null/
$string89_linWinPwn_offensive_tool_keyword = /bloodhound_output_.{0,100}\.txt/
$string90_linWinPwn_offensive_tool_keyword = "bloodhound_output_dconly_"
$string91_linWinPwn_offensive_tool_keyword = /certi\.py_vulntemplates_output/
$string92_linWinPwn_offensive_tool_keyword = "certi_py_enum"
$string93_linWinPwn_offensive_tool_keyword = "certipy_enum"
$string94_linWinPwn_offensive_tool_keyword = "certsync_ntds_dump"
$string95_linWinPwn_offensive_tool_keyword = /cirt\-default\-usernames\.txt/
$string96_linWinPwn_offensive_tool_keyword = /cme_bloodhound_output_.{0,100}\.txt/
$string97_linWinPwn_offensive_tool_keyword = /cme_dfscoerce_output_.{0,100}\.txt/
$string98_linWinPwn_offensive_tool_keyword = "cme_get-desc-users_pass_output_"
$string99_linWinPwn_offensive_tool_keyword = "cme_get-desc-users_pass_results"
$string100_linWinPwn_offensive_tool_keyword = /cme_gpp_output_.{0,100}\.txt/
$string101_linWinPwn_offensive_tool_keyword = "cme_ldap-checker_output_"
$string102_linWinPwn_offensive_tool_keyword = "cme_MachineAccountQuota_output_"
$string103_linWinPwn_offensive_tool_keyword = "cme_ms17-010_output_"
$string104_linWinPwn_offensive_tool_keyword = /cme_mssql_priv_output_.{0,100}\.txt/
$string105_linWinPwn_offensive_tool_keyword = "cme_ntlmv1_output_"
$string106_linWinPwn_offensive_tool_keyword = /cme_passpol_output_.{0,100}\.txt/
$string107_linWinPwn_offensive_tool_keyword = /cme_petitpotam_output_.{0,100}\.txt/
$string108_linWinPwn_offensive_tool_keyword = /cme_printnightmare_output_.{0,100}\.txt/
$string109_linWinPwn_offensive_tool_keyword = /cme_runasppl_output_.{0,100}\.txt/
$string110_linWinPwn_offensive_tool_keyword = /cme_shadowcoerce_output_.{0,100}\.txt/
$string111_linWinPwn_offensive_tool_keyword = "cme_smb_enum"
$string112_linWinPwn_offensive_tool_keyword = /cme_smbsigning_output_.{0,100}\.txt/
$string113_linWinPwn_offensive_tool_keyword = /cme_subnets_output_.{0,100}\.txt/
$string114_linWinPwn_offensive_tool_keyword = "cme_trusted-for-delegation_output_"
$string115_linWinPwn_offensive_tool_keyword = /cme_users_auth_ldap_.{0,100}\.txt/
$string116_linWinPwn_offensive_tool_keyword = /cme_users_auth_smb_.{0,100}\.txt/
$string117_linWinPwn_offensive_tool_keyword = /cme_users_nullsess_smb_.{0,100}\.txt/
$string118_linWinPwn_offensive_tool_keyword = /cme_webdav_output_.{0,100}\.txt/
$string119_linWinPwn_offensive_tool_keyword = /cme_zerologon_output_.{0,100}\.txt/
$string120_linWinPwn_offensive_tool_keyword = "coercer_check"
$string121_linWinPwn_offensive_tool_keyword = /Credentials.{0,100}hekatomb_.{0,100}\.txt/
$string122_linWinPwn_offensive_tool_keyword = "Credentials/certsync_"
$string123_linWinPwn_offensive_tool_keyword = "Credentials/SAMDump"
$string124_linWinPwn_offensive_tool_keyword = "deleg_enum_imp"
$string125_linWinPwn_offensive_tool_keyword = "dfscoerce_check"
$string126_linWinPwn_offensive_tool_keyword = /DomainRecon.{0,100}ridbrute/
$string127_linWinPwn_offensive_tool_keyword = "DomainRecon/ADCS"
$string128_linWinPwn_offensive_tool_keyword = "DomainRecon/BloodHound"
$string129_linWinPwn_offensive_tool_keyword = "DomainRecon/SilentHound"
$string130_linWinPwn_offensive_tool_keyword = "donpapi_dump"
$string131_linWinPwn_offensive_tool_keyword = "dpapi_dump"
$string132_linWinPwn_offensive_tool_keyword = /dpapi_dump_.{0,100}\.txt/
$string133_linWinPwn_offensive_tool_keyword = /enum4linux_.{0,100}\.txt/
$string134_linWinPwn_offensive_tool_keyword = "finduncshar_scan"
$string135_linWinPwn_offensive_tool_keyword = "gmsa_dump"
$string136_linWinPwn_offensive_tool_keyword = "handlekatz_dump"
$string137_linWinPwn_offensive_tool_keyword = "hekatomb_dump"
$string138_linWinPwn_offensive_tool_keyword = "impacket_findDelegation"
$string139_linWinPwn_offensive_tool_keyword = "impacket_rpcdump_output_"
$string140_linWinPwn_offensive_tool_keyword = "john_crack_asrep"
$string141_linWinPwn_offensive_tool_keyword = "john_crack_kerberoast"
$string142_linWinPwn_offensive_tool_keyword = "juicycreds_dump"
$string143_linWinPwn_offensive_tool_keyword = "-k -no-pass -p '' --auth-method kerberos"
$string144_linWinPwn_offensive_tool_keyword = "kerberoast_attack"
$string145_linWinPwn_offensive_tool_keyword = "kerberoast_blind_output_"
$string146_linWinPwn_offensive_tool_keyword = "kerberoast_john_results_"
$string147_linWinPwn_offensive_tool_keyword = "kerbrute_enum"
$string148_linWinPwn_offensive_tool_keyword = "kerbrute_pass_output_"
$string149_linWinPwn_offensive_tool_keyword = "kerbrute_user_output_"
$string150_linWinPwn_offensive_tool_keyword = "kerbrute_userpass_wordlist_"
$string151_linWinPwn_offensive_tool_keyword = "laps_dump"
$string152_linWinPwn_offensive_tool_keyword = "LDAPDomainDump"
$string153_linWinPwn_offensive_tool_keyword = "ldeep_enum"
$string154_linWinPwn_offensive_tool_keyword = "linWinPwn-"
$string155_linWinPwn_offensive_tool_keyword = /linWinPwn\./
$string156_linWinPwn_offensive_tool_keyword = "lsass_dump_"
$string157_linWinPwn_offensive_tool_keyword = "lsass_dump_lsassy_"
$string158_linWinPwn_offensive_tool_keyword = "lsassy_dump"
$string159_linWinPwn_offensive_tool_keyword = "manspider_scan"
$string160_linWinPwn_offensive_tool_keyword = "masky_dump"
$string161_linWinPwn_offensive_tool_keyword = "ms14-068_check"
$string162_linWinPwn_offensive_tool_keyword = "ms17-010_check"
$string163_linWinPwn_offensive_tool_keyword = "msol_dump"
$string164_linWinPwn_offensive_tool_keyword = "nanodump_dump"
$string165_linWinPwn_offensive_tool_keyword = /nmap_smb_scan_custom_.{0,100}\.txt/
$string166_linWinPwn_offensive_tool_keyword = "ntlmv1_check"
$string167_linWinPwn_offensive_tool_keyword = /Passwords\/Leaked\-Databases.{0,100}\.txt/
$string168_linWinPwn_offensive_tool_keyword = "petitpotam_check"
$string169_linWinPwn_offensive_tool_keyword = "printnightmare_check"
$string170_linWinPwn_offensive_tool_keyword = "procdump_dump"
$string171_linWinPwn_offensive_tool_keyword = "pwd_dump "
$string172_linWinPwn_offensive_tool_keyword = "ridbrute_attack"
$string173_linWinPwn_offensive_tool_keyword = /rpc\:\/\/.{0,100}\s\-rpc\-mode\sICPR\s\-icpr\-ca\-name\s/
$string174_linWinPwn_offensive_tool_keyword = "rpcdump_check"
$string175_linWinPwn_offensive_tool_keyword = "runasppl_check"
$string176_linWinPwn_offensive_tool_keyword = "secrets_dump"
$string177_linWinPwn_offensive_tool_keyword = "secrets_dump_dcsync"
$string178_linWinPwn_offensive_tool_keyword = "shadowcoerce_check"
$string179_linWinPwn_offensive_tool_keyword = "Shares/cme_spider_plus"
$string180_linWinPwn_offensive_tool_keyword = /Shares\/finduncshar_.{0,100}\.txt/
$string181_linWinPwn_offensive_tool_keyword = "silenthound_enum"
$string182_linWinPwn_offensive_tool_keyword = /silenthound_output_.{0,100}\.txt/
$string183_linWinPwn_offensive_tool_keyword = "smbmapDump"
$string184_linWinPwn_offensive_tool_keyword = "smbsigning_check"
$string185_linWinPwn_offensive_tool_keyword = "spooler_check"
$string186_linWinPwn_offensive_tool_keyword = "targetedkerberoast_attack"
$string187_linWinPwn_offensive_tool_keyword = /targetedkerberoast_hashes_.{0,100}\.txt/
$string188_linWinPwn_offensive_tool_keyword = /targetedkerberoast_output_.{0,100}\.txt/
$string189_linWinPwn_offensive_tool_keyword = "--trusted-for-delegation --kdcHost "
$string190_linWinPwn_offensive_tool_keyword = /user_eq_pass_valid_cme_.{0,100}\.txt/
$string191_linWinPwn_offensive_tool_keyword = "userpass_cme_check"
$string192_linWinPwn_offensive_tool_keyword = "userpass_kerbrute_check"
$string193_linWinPwn_offensive_tool_keyword = "users_list_cme_ldap_nullsess_"
$string194_linWinPwn_offensive_tool_keyword = "users_list_kerbrute_"
$string195_linWinPwn_offensive_tool_keyword = "users_list_ridbrute_"
$string196_linWinPwn_offensive_tool_keyword = "veeam_dump"
$string197_linWinPwn_offensive_tool_keyword = "Vulnerabilities/RPCDump"
$string198_linWinPwn_offensive_tool_keyword = "windapsearch_enum"
$string199_linWinPwn_offensive_tool_keyword = /xato\-net\-10\-million\-usernames\.txt/
$string200_linWinPwn_offensive_tool_keyword = "zerologon_check"
$metadata_regex_import = /\bimport\s+[a-zA-Z0-9_.]+\b/ nocase
$metadata_regex_function = /function\s+[a-zA-Z_][a-zA-Z0-9_]*\(/ nocase ascii
$metadata_regex_php = /<\?php/ nocase ascii
$metadata_regex_createobject = /(CreateObject|WScript\.)/ nocase ascii
$metadata_regex_script = /<script\b/ nocase ascii
$metadata_regex_javascript = /(let\s|const\s|function\s|document\.|console\.)/ nocase ascii
$metadata_regex_powershell = /(Write-Host|Get-[a-zA-Z]+|Invoke-|param\(|\.SYNOPSIS)/ nocase ascii
$metadata_regex_batch = /@(echo\s|call\s|set\s|goto\s|if\s|for\s|rem\s)/ nocase ascii
$metadata_regex_shebang = /^#!\// nocase ascii
condition:
((filesize < 20MB and (
uint16(0) == 0x5a4d or uint16(0) == 0x457f or uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or uint32(0) == 0x504B0304 or uint32(0) == 0xCAFEBABE or uint32(0) == 0x4D534346 or uint32(0) == 0xD0CF11E0 or uint16(0) == 0x2321 or uint16(0) == 0x3c3f )) and 2 of ($string*)) or
(filesize < 2MB and
(
2 of ($string*) and
for any of ($metadata_regex_*) : ( @ <= 20000 )
))
}