Nltest.EXE Execution

Status: test
Severity: low
Log source: category process_creation, product windows
Author: Arun Chauhan
Source: github.com/SigmaHQ/sigma

Detects nltest commands that can be used for information discovery

Known false positives

Legitimate administration activity

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1016` System Network Configuration Discovery `T1018` Remote System Discovery `T1482` Domain Trust Discovery

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Nltest.EXE Execution
id: 903076ff-f442-475a-b667-4f246bcc203b
related:
    - id: 5cc90652-4cbd-4241-aa3b-4b462fa5a248
      type: similar
    - id: eeb66bbb-3dde-4582-815a-584aee9fe6d1
      type: obsolete
status: test
description: Detects nltest commands that can be used for information discovery
references:
    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm
author: Arun Chauhan
date: 2023-02-03
tags:
    - attack.discovery
    - attack.t1016
    - attack.t1018
    - attack.t1482
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\nltest.exe'
        - OriginalFileName: 'nltestrk.exe'
    condition: selection
falsepositives:
    - Legitimate administration activity
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Image|endswith: '\nltest.exe'
    - OriginalFileName: 'nltestrk.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\nltest.exe` corpus 9 (sigma 9)	`field:"Image" kind:ends_with value:"\nltest.exe"`
`OriginalFileName`	eq	`nltestrk.exe` corpus 4 (sigma 2, splunk 2)	`field:"OriginalFileName" kind:eq value:"nltestrk.exe"`

Nltest.EXE Execution

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`