linWinPwn
YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'linWinPwn' taken from the ThreatHunting-Keywords github project
rule linWinPwn
{
meta:
description = "Detection patterns for the tool 'linWinPwn' taken from the ThreatHunting-Keywords github project"
author = "@mthcht"
reference = "https://github.com/mthcht/ThreatHunting-Keywords"
tool = "linWinPwn"
rule_category = "offensive_tool_keyword"
strings:
$string1 = " aad3b435b51404eeaad3b435b51404ee"
$string2 = " --asreproast "
$string3 = /\scoerce\s.{0,100}\s\-\-dc\-ip\s/
$string4 = /\s\-\-dc\s.{0,100}\s\-m\scustom\s\-\-filter\s.{0,100}objectCategory/
$string5 = /\s\-dc\-ip\s.{0,100}\s\-dump\s/
$string6 = /\s\-\-dc\-ip\s.{0,100}\s\-\-vuln\s\-\-enabled/
$string7 = /\s\-dc\-ip\s.{0,100}SAMDump/
$string8 = " --force-kerb "
$string9 = /\s\-\-format\=krb5asrep.{0,100}\s\-\-wordlist\=/
$string10 = " -g -n --kerberoast"
$string11 = " --impersonate Administrator -shell "
$string12 = /\s\-ip\s.{0,100}\s\-smb2support\s.{0,100}lwpshare.{0,100}\s/
$string13 = /\sldap\s.{0,100}\s\-\-gmsa\s.{0,100}dump/
$string14 = " linWinPwn"
$string15 = " -M dfscoerce "
$string16 = " -M handlekatz "
$string17 = " -M keepass_discover "
$string18 = " -M laps --kdcHost "
$string19 = " -M ldap-checker "
$string20 = " -M lsassy "
$string21 = " -M MAQ --kdcHost "
$string22 = /\s\-M\smasky\s.{0,100}CA\=/
$string23 = " -M ms17-010 "
$string24 = " -M mssql_priv "
$string25 = " -M nanodump "
$string26 = " -M petitpotam "
$string27 = " -M printnightmare "
$string28 = " -m privileged-users --full "
$string29 = " -M procdump "
$string30 = " -M runasppl "
$string31 = " -M shadowcoerce "
$string32 = " -M spider_plus "
$string33 = " -M teams_localdb "
$string34 = " -M zerologon "
$string35 = " -no-pass -just-dc-user "
$string36 = /\s\-no\-preauth\s.{0,100}\s\-dc\-ip\s/
$string37 = " --only-abuse --dc-host "
$string38 = /\s\-\-password\-not\-required\s\-\-kdcHost\s.{0,100}cme/
$string39 = /\s\-pfx\s.{0,100}\.pfx\s\-dc\-ip\s/
$string40 = " -request -dc-ip "
$string41 = /\s\-\-rid\-brute\s2\>\&1\s.{0,100}\.txt/
$string42 = " -save-old -dc-ip "
$string43 = /\sscan\s.{0,100}\s\-\-dc\-ip\s/
$string44 = /\ssmb\s.{0,100}\s\-\-dpapi\s.{0,100}password/
$string45 = /\ssmb\s.{0,100}\s\-\-gen\-relay\-list\s.{0,100}\.txt/
$string46 = /\ssmb\s.{0,100}\s\-\-lsa\s\-\-log\s/
$string47 = /\ssmb\s.{0,100}\s\-M\smsol\s/
$string48 = /\ssmb\s.{0,100}\s\-M\sntlmv1\s/
$string49 = /\ssmb\s.{0,100}\s\-\-ntds\s\-\-log\s/
$string50 = /\ssmb\s.{0,100}\s\-\-sam\s\-\-log\s/
$string51 = /\suserenum\s.{0,100}\s\-\-dc\s/
$string52 = " -vulnerable -stdout -hide-admins"
$string53 = /\$attacker_IPlist/
$string54 = /\/asreproast_hashes_.{0,100}\.txt/
$string55 = /\/cme_adcs_output_.{0,100}\.txt/
$string56 = "/cme_shares_output_"
$string57 = "/cme_spooler_output_"
$string58 = /\/coercer_output_.{0,100}\.txt/
$string59 = /\/Credentials\/.{0,100}\.ccache/
$string60 = /\/Credentials\/firefox_.{0,100}\.txt/
$string61 = /\/Credentials\/msol_.{0,100}\.txt/
$string62 = /\/dcsync_.{0,100}\.txt/
$string63 = /\/DomainRecon\/.{0,100}\.txt/
$string64 = /\/gMSA_dump_.{0,100}\.txt/
$string65 = /\/keepass_discover_.{0,100}\.txt/
$string66 = /\/kerberoast_hashes_.{0,100}\.txt/
$string67 = /\/laps_dump_.{0,100}\.txt/
$string68 = "/ldeepDump"
$string69 = "/linWinPwn"
$string70 = /\/lsa_dump_.{0,100}\.txt/
$string71 = /\/manspider_output.{0,100}\.txt/
$string72 = "/manspiderDump"
$string73 = /\/nmap_smb_scan_all_.{0,100}\.txt/
$string74 = /\/ntds_dump_.{0,100}\.txt/
$string75 = "/opt/lwp-scripts"
$string76 = "/opt/lwp-wordlists"
$string77 = /\/rockyou\.txt/
$string78 = /\/sam_dump_.{0,100}\.txt/
$string79 = /\/Scans\/servers_all_smb.{0,100}\.txt/
$string80 = /\/secretsdump_.{0,100}\.txt/
$string81 = "/smbmapDump"
$string82 = /\/windapsearch_.{0,100}\.txt/
$string83 = "asrep_attack"
$string84 = "asreprc4_attack"
$string85 = "asreproast_john_results_"
$string86 = /asreproast_output_.{0,100}\.txt/
$string87 = "bhd_enum_dconly"
$string88 = /bloodhound_output.{0,100}\/dev\/null/
$string89 = /bloodhound_output_.{0,100}\.txt/
$string90 = "bloodhound_output_dconly_"
$string91 = /certi\.py_vulntemplates_output/
$string92 = "certi_py_enum"
$string93 = "certipy_enum"
$string94 = "certsync_ntds_dump"
$string95 = /cirt\-default\-usernames\.txt/
$string96 = /cme_bloodhound_output_.{0,100}\.txt/
$string97 = /cme_dfscoerce_output_.{0,100}\.txt/
$string98 = "cme_get-desc-users_pass_output_"
$string99 = "cme_get-desc-users_pass_results"
$string100 = /cme_gpp_output_.{0,100}\.txt/
$string101 = "cme_ldap-checker_output_"
$string102 = "cme_MachineAccountQuota_output_"
$string103 = "cme_ms17-010_output_"
$string104 = /cme_mssql_priv_output_.{0,100}\.txt/
$string105 = "cme_ntlmv1_output_"
$string106 = /cme_passpol_output_.{0,100}\.txt/
$string107 = /cme_petitpotam_output_.{0,100}\.txt/
$string108 = /cme_printnightmare_output_.{0,100}\.txt/
$string109 = /cme_runasppl_output_.{0,100}\.txt/
$string110 = /cme_shadowcoerce_output_.{0,100}\.txt/
$string111 = "cme_smb_enum"
$string112 = /cme_smbsigning_output_.{0,100}\.txt/
$string113 = /cme_subnets_output_.{0,100}\.txt/
$string114 = "cme_trusted-for-delegation_output_"
$string115 = /cme_users_auth_ldap_.{0,100}\.txt/
$string116 = /cme_users_auth_smb_.{0,100}\.txt/
$string117 = /cme_users_nullsess_smb_.{0,100}\.txt/
$string118 = /cme_webdav_output_.{0,100}\.txt/
$string119 = /cme_zerologon_output_.{0,100}\.txt/
$string120 = "coercer_check"
$string121 = /Credentials.{0,100}hekatomb_.{0,100}\.txt/
$string122 = "Credentials/certsync_"
$string123 = "Credentials/SAMDump"
$string124 = "deleg_enum_imp"
$string125 = "dfscoerce_check"
$string126 = /DomainRecon.{0,100}ridbrute/
$string127 = "DomainRecon/ADCS"
$string128 = "DomainRecon/BloodHound"
$string129 = "DomainRecon/SilentHound"
$string130 = "donpapi_dump"
$string131 = "dpapi_dump"
$string132 = /dpapi_dump_.{0,100}\.txt/
$string133 = /enum4linux_.{0,100}\.txt/
$string134 = "finduncshar_scan"
$string135 = "gmsa_dump"
$string136 = "handlekatz_dump"
$string137 = "hekatomb_dump"
$string138 = "impacket_findDelegation"
$string139 = "impacket_rpcdump_output_"
$string140 = "john_crack_asrep"
$string141 = "john_crack_kerberoast"
$string142 = "juicycreds_dump"
$string143 = "-k -no-pass -p '' --auth-method kerberos"
$string144 = "kerberoast_attack"
$string145 = "kerberoast_blind_output_"
$string146 = "kerberoast_john_results_"
$string147 = "kerbrute_enum"
$string148 = "kerbrute_pass_output_"
$string149 = "kerbrute_user_output_"
$string150 = "kerbrute_userpass_wordlist_"
$string151 = "laps_dump"
$string152 = "LDAPDomainDump"
$string153 = "ldeep_enum"
$string154 = "linWinPwn-"
$string155 = /linWinPwn\./
$string156 = "lsass_dump_"
$string157 = "lsass_dump_lsassy_"
$string158 = "lsassy_dump"
$string159 = "manspider_scan"
$string160 = "masky_dump"
$string161 = "ms14-068_check"
$string162 = "ms17-010_check"
$string163 = "msol_dump"
$string164 = "nanodump_dump"
$string165 = /nmap_smb_scan_custom_.{0,100}\.txt/
$string166 = "ntlmv1_check"
$string167 = /Passwords\/Leaked\-Databases.{0,100}\.txt/
$string168 = "petitpotam_check"
$string169 = "printnightmare_check"
$string170 = "procdump_dump"
$string171 = "pwd_dump "
$string172 = "ridbrute_attack"
$string173 = /rpc\:\/\/.{0,100}\s\-rpc\-mode\sICPR\s\-icpr\-ca\-name\s/
$string174 = "rpcdump_check"
$string175 = "runasppl_check"
$string176 = "secrets_dump"
$string177 = "secrets_dump_dcsync"
$string178 = "shadowcoerce_check"
$string179 = "Shares/cme_spider_plus"
$string180 = /Shares\/finduncshar_.{0,100}\.txt/
$string181 = "silenthound_enum"
$string182 = /silenthound_output_.{0,100}\.txt/
$string183 = "smbmapDump"
$string184 = "smbsigning_check"
$string185 = "spooler_check"
$string186 = "targetedkerberoast_attack"
$string187 = /targetedkerberoast_hashes_.{0,100}\.txt/
$string188 = /targetedkerberoast_output_.{0,100}\.txt/
$string189 = "--trusted-for-delegation --kdcHost "
$string190 = /user_eq_pass_valid_cme_.{0,100}\.txt/
$string191 = "userpass_cme_check"
$string192 = "userpass_kerbrute_check"
$string193 = "users_list_cme_ldap_nullsess_"
$string194 = "users_list_kerbrute_"
$string195 = "users_list_ridbrute_"
$string196 = "veeam_dump"
$string197 = "Vulnerabilities/RPCDump"
$string198 = "windapsearch_enum"
$string199 = /xato\-net\-10\-million\-usernames\.txt/
$string200 = "zerologon_check"
$metadata_regex_import = /\bimport\s+[a-zA-Z0-9_.]+\b/ nocase
$metadata_regex_function = /function\s+[a-zA-Z_][a-zA-Z0-9_]*\(/ nocase ascii
$metadata_regex_php = /<\?php/ nocase ascii
$metadata_regex_createobject = /(CreateObject|WScript\.)/ nocase ascii
$metadata_regex_script = /<script\b/ nocase ascii
$metadata_regex_javascript = /(let\s|const\s|function\s|document\.|console\.)/ nocase ascii
$metadata_regex_powershell = /(Write-Host|Get-[a-zA-Z]+|Invoke-|param\(|\.SYNOPSIS)/ nocase ascii
$metadata_regex_batch = /@(echo\s|call\s|set\s|goto\s|if\s|for\s|rem\s)/ nocase ascii
$metadata_regex_shebang = /^#!\// nocase ascii
condition:
((filesize < 20MB and (
uint16(0) == 0x5a4d or uint16(0) == 0x457f or uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca or uint32(0) == 0x504B0304 or uint32(0) == 0xCAFEBABE or uint32(0) == 0x4D534346 or uint32(0) == 0xD0CF11E0 or uint16(0) == 0x2321 or uint16(0) == 0x3c3f )) and 2 of ($string*)) or
(filesize < 2MB and
(
2 of ($string*) and
for any of ($metadata_regex_*) : ( @ <= 20000 )
))
}