Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line

title: "Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line"
id: 995ab44f-ed25-4bbb-b9d6-fc000054ff18
status: test
description: This rule identifies execution of PingCastle by matching PE metadata for original file names associated with PingCastleReporting.exe, PingCastleCloud.exe, and PingCastle.exe, combined with PingCastle scanner-related command-line arguments. Renaming the binary is a common evasion technique, and attackers may still pass recognizable scanner flags to perform reconnaissance or health checks. The detection relies on Windows process creation telemetry, including process command line and PE metadata fields.
references:
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://www.pingcastle.com/documentation/scanner/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_pingcastle.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2024-01-11
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName:
        - PingCastleReporting.exe
        - PingCastleCloud.exe
        - PingCastle.exe
    - CommandLine|contains:
        - --scanner aclcheck
        - --scanner antivirus
        - --scanner computerversion
        - --scanner foreignusers
        - --scanner laps_bitlocker
        - --scanner localadmin
        - --scanner nullsession
        - --scanner nullsession-trust
        - --scanner oxidbindings
        - --scanner remote
        - --scanner share
        - --scanner smb
        - --scanner smb3querynetwork
        - --scanner spooler
        - --scanner startup
        - --scanner zerologon
    - CommandLine|contains: --no-enum-limit
    - CommandLine|contains|all:
        - --healthcheck
        - --level Full
    - CommandLine|contains|all:
        - --healthcheck
        - "--server "
  filter_main_img:
    Image|endswith:
      - \PingCastleReporting.exe
      - \PingCastleCloud.exe
      - \PingCastle.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2433a154-bb3d-42e4-86c3-a26bdac91c45
    type: derived