MpiExec Lolbin
Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary
Sigma rule (View on GitHub)
1title: MpiExec Lolbin
2id: 729ce0ea-5d8f-4769-9762-e35de441586d
3status: test
4description: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary
5references:
6 - https://twitter.com/mrd0x/status/1465058133303246867
7 - https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps
8author: Florian Roth (Nextron Systems)
9date: 2022-01-11
10modified: 2022-03-04
11tags:
12 - attack.execution
13 - attack.defense-evasion
14 - attack.t1218
15logsource:
16 category: process_creation
17 product: windows
18detection:
19 selection_binary:
20 - Image|endswith: '\mpiexec.exe'
21 - Imphash: 'd8b52ef6aaa3a81501bdfff9dbb96217'
22 - Hashes|contains: 'IMPHASH=d8b52ef6aaa3a81501bdfff9dbb96217'
23 selection_flags:
24 CommandLine|contains:
25 - ' /n 1 '
26 - ' -n 1 '
27 condition: all of selection*
28falsepositives:
29 - Unknown
30level: high
References
Related rules
- Arbitrary File Download Via MSOHTMED.EXE
- Arbitrary File Download Via MSPUB.EXE
- Arbitrary File Download Via PresentationHost.EXE
- Arbitrary MSI Download Via Devinit.EXE
- Created Files by Microsoft Sync Center