HackTool - Inveigh Execution

Status: test
Severity: critical
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

Known false positives

Very unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: HackTool - Inveigh Execution
id: b99a1518-1ad5-4f65-bc95-1ffff97a8fd0
status: test
description: Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool
references:
    - https://github.com/Kevin-Robertson/Inveigh
    - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-24
modified: 2023-02-04
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\Inveigh.exe'
        - OriginalFileName:
              - '\Inveigh.exe'
              - '\Inveigh.dll'
        - Description: 'Inveigh'
        - CommandLine|contains:
              - ' -SpooferIP'
              - ' -ReplyToIPs '
              - ' -ReplyToDomains '
              - ' -ReplyToMACs '
              - ' -SnifferIP'
    condition: selection
falsepositives:
    - Very unlikely
level: critical

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Image|endswith: '\Inveigh.exe'
    - OriginalFileName:
          - '\Inveigh.exe'
          - '\Inveigh.dll'
    - Description: 'Inveigh'
    - CommandLine|contains:
          - ' -SpooferIP'
          - ' -ReplyToIPs '
          - ' -ReplyToDomains '
          - ' -ReplyToMACs '
          - ' -SnifferIP'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-ReplyToDomains` `-ReplyToIPs` `-ReplyToMACs` `-SnifferIP` `-SpooferIP`	`field:"CommandLine" kind:match`
`Description`	eq	`Inveigh`	`field:"Description" kind:eq value:"Inveigh"`
`Image`	ends_with	`\Inveigh.exe`	`field:"Image" kind:ends_with value:"\Inveigh.exe"`
`OriginalFileName`	eq	`\Inveigh.dll` `\Inveigh.exe`	`field:"OriginalFileName" kind:eq`

HackTool - Inveigh Execution

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`