HackTool - Impersonate Execution

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Sai Prashanth Pulisetti @pulisettis
Source: github.com/SigmaHQ/sigma

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1134.001` Access Token Manipulation: Token Impersonation/Theft `T1134.003` Access Token Manipulation: Make and Impersonate Token
Stealth	`T1134.001` Access Token Manipulation: Token Impersonation/Theft `T1134.003` Access Token Manipulation: Make and Impersonate Token

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: HackTool - Impersonate Execution
id: cf0c254b-22f1-4b2b-8221-e137b3c0af94
status: test
description: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
references:
    - https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/
    - https://github.com/sensepost/impersonate
author: Sai Prashanth Pulisetti @pulisettis
date: 2022-12-21
modified: 2024-11-23
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1134.001
    - attack.t1134.003
logsource:
    product: windows
    category: process_creation
detection:
    selection_commandline_exe:
        CommandLine|contains: 'impersonate.exe'
    selection_commandline_opt:
        CommandLine|contains:
            - ' list '
            - ' exec '
            - ' adduser '
    selection_hash:
        Hashes|contains:
            - 'MD5=9520714AB576B0ED01D1513691377D01'
            - 'SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A'
            - 'IMPHASH=0A358FFC1697B7A07D0E817AC740DF62'
    condition: all of selection_commandline_* or selection_hash
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_commandline_* or selection_hash

Stage 1: `selection_commandline_exe`

selection_commandline_exe:
    CommandLine|contains: 'impersonate.exe'

Stage 2: `selection_commandline_opt`

selection_commandline_opt:
    CommandLine|contains:
        - ' list '
        - ' exec '
        - ' adduser '

Stage 3: `selection_hash`

selection_hash:
    Hashes|contains:
        - 'MD5=9520714AB576B0ED01D1513691377D01'
        - 'SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A'
        - 'IMPHASH=0A358FFC1697B7A07D0E817AC740DF62'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`adduser` `exec` corpus 3 (sigma 2, splunk 1) `list` corpus 2 (sigma 2) `impersonate.exe`	`field:"CommandLine" kind:match`
`Hashes`	match	`IMPHASH=0A358FFC1697B7A07D0E817AC740DF62` `MD5=9520714AB576B0ED01D1513691377D01` `SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A`	`field:"Hashes" kind:match`

HackTool - Impersonate Execution

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_commandline_exe

Stage 2: selection_commandline_opt

Stage 3: selection_hash

Indicators

Stage 0: `condition`

Stage 1: `selection_commandline_exe`

Stage 2: `selection_commandline_opt`

Stage 3: `selection_hash`