Hacktool Ruler

calendar Feb 1, 2023 · attack.discovery attack.execution attack.t1087 attack.t1114 attack.t1059 attack.t1550.002  ·
Share on: linkedin copy

This events that are generated when using the hacktool Ruler by Sensepost

Sigma rule (View on GitHub)

 1title: Hacktool Ruler
 2id: 24549159-ac1b-479c-8175-d42aea947cae
 3status: test
 4description: This events that are generated when using the hacktool Ruler by Sensepost
 5references:
 6    - https://github.com/sensepost/ruler
 7    - https://github.com/sensepost/ruler/issues/47
 8    - https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427
 9    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
10    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
11author: Florian Roth (Nextron Systems)
12date: 2017/05/31
13modified: 2022/10/09
14tags:
15    - attack.discovery
16    - attack.execution
17    - attack.t1087
18    - attack.t1114
19    - attack.t1059
20    - attack.t1550.002
21logsource:
22    product: windows
23    service: security
24detection:
25    selection1:
26        EventID: 4776
27        Workstation: 'RULER'
28    selection2:
29        EventID:
30            - 4624
31            - 4625
32        WorkstationName: 'RULER'
33    condition: (1 of selection*)
34falsepositives:
35    - Go utilities that use staaldraad awesome NTLM library
36level: high

References

Related rules

to-top