Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line
Flags Windows processes that look like renamed PingCastle executables using PE original file names and PingCastle scanner/healthcheck arguments.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-01-11
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of PingCastle by matching PE metadata for original file names associated with PingCastleReporting.exe, PingCastleCloud.exe, and PingCastle.exe, combined with PingCastle scanner-related command-line arguments. Renaming the binary is a common evasion technique, and attackers may still pass recognizable scanner flags to perform reconnaissance or health checks. The detection relies on Windows process creation telemetry, including process command line and PE metadata fields.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line"
id: 995ab44f-ed25-4bbb-b9d6-fc000054ff18
status: test
description: This rule identifies execution of PingCastle by matching PE metadata for original file names associated with PingCastleReporting.exe, PingCastleCloud.exe, and PingCastle.exe, combined with PingCastle scanner-related command-line arguments. Renaming the binary is a common evasion technique, and attackers may still pass recognizable scanner flags to perform reconnaissance or health checks. The detection relies on Windows process creation telemetry, including process command line and PE metadata fields.
references:
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- https://www.pingcastle.com/documentation/scanner/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_pingcastle.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2024-01-11
tags:
- attack.execution
- attack.stealth
- attack.t1059
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection:
- OriginalFileName:
- PingCastleReporting.exe
- PingCastleCloud.exe
- PingCastle.exe
- CommandLine|contains:
- --scanner aclcheck
- --scanner antivirus
- --scanner computerversion
- --scanner foreignusers
- --scanner laps_bitlocker
- --scanner localadmin
- --scanner nullsession
- --scanner nullsession-trust
- --scanner oxidbindings
- --scanner remote
- --scanner share
- --scanner smb
- --scanner smb3querynetwork
- --scanner spooler
- --scanner startup
- --scanner zerologon
- CommandLine|contains: --no-enum-limit
- CommandLine|contains|all:
- --healthcheck
- --level Full
- CommandLine|contains|all:
- --healthcheck
- "--server "
filter_main_img:
Image|endswith:
- \PingCastleReporting.exe
- \PingCastleCloud.exe
- \PingCastle.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 2433a154-bb3d-42e4-86c3-a26bdac91c45
type: derived