Hacktool Ruler

calendar May 20, 2025 · attack.discovery attack.execution attack.collection attack.t1087 attack.t1114 attack.t1059 attack.t1550.002  ·
Share on: linkedin copy

This events that are generated when using the hacktool Ruler by Sensepost

Sigma rule (View on GitHub)

 1title: Hacktool Ruler
 2id: 24549159-ac1b-479c-8175-d42aea947cae
 3status: test
 4description: This events that are generated when using the hacktool Ruler by Sensepost
 5references:
 6    - https://github.com/sensepost/ruler
 7    - https://github.com/sensepost/ruler/issues/47
 8    - https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427
 9    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
10    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624
11author: Florian Roth (Nextron Systems)
12date: 2017-05-31
13modified: 2022-10-09
14tags:
15    - attack.discovery
16    - attack.execution
17    - attack.collection
18    - attack.t1087
19    - attack.t1114
20    - attack.t1059
21    - attack.t1550.002
22logsource:
23    product: windows
24    service: security
25detection:
26    selection1:
27        EventID: 4776
28        Workstation: 'RULER'
29    selection2:
30        EventID:
31            - 4624
32            - 4625
33        WorkstationName: 'RULER'
34    condition: (1 of selection*)
35falsepositives:
36    - Go utilities that use staaldraad awesome NTLM library
37level: high

References

Related rules

to-top