HackTool - Impacket Tools Execution

Title: HackTool - Impacket Tools Execution
Status: test
Description:Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)
References:
  -https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries
Author: Florian Roth (Nextron Systems)
Date: 2021-07-24
modified:2023-02-07
Tags:

• -'attack.collection'
• -'attack.execution'
• -'attack.credential-access'
• -'attack.t1557.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    - Image|contains:
      - '\goldenPac'
      - '\karmaSMB'
      - '\kintercept'
      - '\ntlmrelayx'
      - '\rpcdump'
      - '\samrdump'
      - '\secretsdump'
      - '\smbexec'
      - '\smbrelayx'
      - '\wmiexec'
      - '\wmipersist'
    - Image|endswith:
      - '\atexec_windows.exe'
      - '\dcomexec_windows.exe'
      - '\dpapi_windows.exe'
      - '\findDelegation_windows.exe'
      - '\GetADUsers_windows.exe'
      - '\GetNPUsers_windows.exe'
      - '\getPac_windows.exe'
      - '\getST_windows.exe'
      - '\getTGT_windows.exe'
      - '\GetUserSPNs_windows.exe'
      - '\ifmap_windows.exe'
      - '\mimikatz_windows.exe'
      - '\netview_windows.exe'
      - '\nmapAnswerMachine_windows.exe'
      - '\opdump_windows.exe'
      - '\psexec_windows.exe'
      - '\rdp_check_windows.exe'
      - '\sambaPipe_windows.exe'
      - '\smbclient_windows.exe'
      - '\smbserver_windows.exe'
      - '\sniff_windows.exe'
      - '\sniffer_windows.exe'
      - '\split_windows.exe'
      - '\ticketer_windows.exe'
  condition:selection
Falsepositives:
  -Legitimate use of the impacket tools
Level: high