cscli scenarios install sigmahq/proc_creation_win_hktl_relay_attacks_tools1type: trigger2name: sigmahq/proc_creation_win_hktl_relay_attacks_tools3description: |4 Detects different hacktools used for relay attacks on Windows for privilege escalation5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image contains 'PetitPotam' || evt.Parsed.Image contains 'RottenPotato' || evt.Parsed.Image contains 'HotPotato' || evt.Parsed.Image contains 'JuicyPotato' || evt.Parsed.Image contains '\\just_dce_' || evt.Parsed.Image contains 'Juicy Potato' || evt.Parsed.Image contains '\\temp\\rot.exe' || evt.Parsed.Image contains '\\Potato.exe' || evt.Parsed.Image contains '\\SpoolSample.exe' || evt.Parsed.Image contains '\\Responder.exe' || evt.Parsed.Image contains '\\smbrelayx' || evt.Parsed.Image contains '\\ntlmrelayx' || evt.Parsed.Image contains '\\LocalPotato' || evt.Parsed.CommandLine contains 'Invoke-Tater' || evt.Parsed.CommandLine contains ' smbrelay' || evt.Parsed.CommandLine contains ' ntlmrelay' || evt.Parsed.CommandLine contains 'cme smb ' || evt.Parsed.CommandLine contains ' /ntlm:NTLMhash ' || evt.Parsed.CommandLine contains 'Invoke-PetitPotam' || Match('.exe -t -p ', evt.Parsed.CommandLine) || evt.Parsed.CommandLine contains '.exe -c "{' && evt.Parsed.CommandLine endsWith '}" -z') && not (evt.Parsed.Image contains 'HotPotatoes6' || evt.Parsed.Image contains 'HotPotatoes7' || evt.Parsed.Image contains 'HotPotatoes '))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1557.0011516 label: "Potential SMB Relay Attack Tool Execution"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324