MpiExec Lolbin
Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary
Sigma rule (View on GitHub)
1title: MpiExec Lolbin
2id: 729ce0ea-5d8f-4769-9762-e35de441586d
3status: test
4description: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary
5references:
6 - https://twitter.com/mrd0x/status/1465058133303246867
7 - https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps
8author: Florian Roth (Nextron Systems)
9date: 2022-01-11
10modified: 2024-11-23
11tags:
12 - attack.execution
13 - attack.defense-evasion
14 - attack.t1218
15logsource:
16 category: process_creation
17 product: windows
18detection:
19 selection_binary:
20 - Image|endswith: '\mpiexec.exe'
21 - Hashes|contains: 'IMPHASH=d8b52ef6aaa3a81501bdfff9dbb96217'
22 selection_flags:
23 CommandLine|contains:
24 - ' /n 1 '
25 - ' -n 1 '
26 condition: all of selection*
27falsepositives:
28 - Unknown
29level: high
References
Related rules
- Potential Compromised 3CXDesktopApp Execution
- Binary Proxy Execution Via Dotnet-Trace.EXE
- Arbitrary File Download Via IMEWDBLD.EXE
- Arbitrary File Download Via MSEDGE_PROXY.EXE
- Arbitrary File Download Via Squirrel.EXE