Nltest.EXE Execution

calendar Dec 1, 2023 · attack.discovery attack.t1016 attack.t1018 attack.t1482  ·
Share on: linkedin copy

Detects nltest commands that can be used for information discovery

Sigma rule (View on GitHub)

 1title: Nltest.EXE Execution
 2id: 903076ff-f442-475a-b667-4f246bcc203b
 3related:
 4    - id: 5cc90652-4cbd-4241-aa3b-4b462fa5a248
 5      type: similar
 6    - id: eeb66bbb-3dde-4582-815a-584aee9fe6d1
 7      type: obsoletes
 8status: test
 9description: Detects nltest commands that can be used for information discovery
10references:
11    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm
12author: Arun Chauhan
13date: 2023/02/03
14tags:
15    - attack.discovery
16    - attack.t1016
17    - attack.t1018
18    - attack.t1482
19logsource:
20    category: process_creation
21    product: windows
22detection:
23    selection:
24        - Image|endswith: '\nltest.exe'
25        - OriginalFileName: 'nltestrk.exe'
26    condition: selection
27falsepositives:
28    - Legitimate administration activity
29level: low

References

  • nltest /dsgetdc: /force

    1 Microsoft-Windows-Sysmon/Operational 1 Process Create (rule: ProcessCreate) Process Create. LogonGuid/LogonId: ID of the logon session ParentProcessGuid/ParentProcessId: Process ID of the parent ...


    Read More

Related rules

to-top