PUA - Crassus Execution

Title: PUA - Crassus Execution
Status: test
Description:Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.
References:
  -https://github.com/vu-ls/Crassus
Author: pH-T (Nextron Systems)
Date: 2023-04-17
modified:None
Tags:

• -'attack.discovery'
• -'attack.reconnaissance'
• -'attack.t1590.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\Crassus.exe' OriginalFileName:'Crassus.exe' Description|contains:'Crassus'   condition:selection
Falsepositives:
  -Unlikely
Level: high