Impacket AtExec Suspicious Temp File Creation
Detects Atexec.py (Impacket) suspicious file creation in Windows temp directory.
Sigma rule (View on GitHub)
1title: Impacket AtExec Suspicious Temp File Creation
2id: 22514cf3-83dd-4949-931e-69a6d6abe154
3status: experimental
4description: Detects Atexec.py (Impacket) suspicious file creation in Windows temp directory.
5references:
6 - https://www.13cubed.com/downloads/impacket_exec_commands_cheat_sheet.pdf
7 - https://www.hackingarticles.in/impacket-guide-smb-msrpc/
8 - https://u0041.co/blog/post/1
9author: Micah Babinski
10date: 2023/01/08
11tags:
12 - attack.s0357
13 - attack.execution
14 - attack.t1053
15 - attack.t1053.002
16logsource:
17 product: windows
18 category: file_event
19detection:
20 selection:
21 Image|endswith: '\cmd.exe'
22 TargetFilename|re: '^C:\\Windows\\Temp\\[A-Za-z]{8}\.tmp$'
23 condition: selection
24falsepositives:
25 - Unknown
26level: low```
References
-
There have been many Red Team scenarios, Capture the Flag challenges where we face the Windows Server. After exploiting and getting the initial foothold in
Read More
Related rules
- Impacket AtExec Suspicious Registry Modification
- Possible Impacket AtExec Activity
- Windows Scheduled Task Behaving Improperly or Suspiciously
- Windows Scheduled Task Create Shell
- Windows Scheduled Task Making Suspicious Network Connection