Hacktool Ruler

Title: Hacktool Ruler
Status: test
Description:This events that are generated when using the hacktool Ruler by Sensepost
References:
  -https://github.com/sensepost/ruler
  -https://github.com/sensepost/ruler/issues/47
  -https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
  -https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624
Author: Florian Roth (Nextron Systems)
Date: 2017-05-31
modified:2022-10-09
Tags:

• -'attack.discovery'
• -'attack.execution'
• -'attack.collection'
• -'attack.lateral-movement'
• -'attack.t1087'
• -'attack.t1114'
• -'attack.t1059'
• -'attack.t1550.002'

Logsource:

• product: windows
• service: security

Detection:
  selection1:
    EventID: '4776'
    Workstation: 'RULER'
  selection2:
    EventID:
      -'4624'
      -'4625'

    WorkstationName: 'RULER'
  condition:(1 of selection*)
Falsepositives:
  -Go utilities that use staaldraad awesome NTLM library
Level: high