Nltest.EXE Execution

Title: Nltest.EXE Execution
Status: test
Description:Detects nltest commands that can be used for information discovery
References:
  -https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm
Author: Arun Chauhan
Date: 2023-02-03
modified:None
Tags:

• -'attack.discovery'
• -'attack.t1016'
• -'attack.t1018'
• -'attack.t1482'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\nltest.exe' OriginalFileName:'nltestrk.exe'   condition:selection
Falsepositives:
  -Legitimate administration activity
Level: low