huntrule

Windows: Inveigh HackTool Execution Artefacts via Dropped Files

Alert on Windows file creation or presence of Inveigh log, script, and binary artefacts identified by distinctive filename suffixes.

FreeUnreviewedSigmacriticalv1
title: "Windows: Inveigh HackTool Execution Artefacts via Dropped Files"
id: a9119f9f-87f0-44bd-8ec5-e4b30779aa5e
status: test
description: This rule flags Windows file events where Inveigh-specific artefacts are created or present, based on filename suffixes for log files, configuration/input files, and Inveigh binaries/scripts. Attackers commonly use Inveigh to capture and relay authentication material, so the presence of these distinct artefacts is strong evidence of tool deployment. The detection relies on Windows file event telemetry that records target filenames and supports matching on the specified filename endings.
references:
  - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs
  - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs
  - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_inveigh_artefacts.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-24
modified: 2024-06-27
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - \Inveigh-Log.txt
      - \Inveigh-Cleartext.txt
      - \Inveigh-NTLMv1Users.txt
      - \Inveigh-NTLMv2Users.txt
      - \Inveigh-NTLMv1.txt
      - \Inveigh-NTLMv2.txt
      - \Inveigh-FormInput.txt
      - \Inveigh.dll
      - \Inveigh.exe
      - \Inveigh.ps1
      - \Inveigh-Relay.ps1
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: bb09dd3e-2b78-4819-8e35-a7c1b874e449
    type: derived

What it detects

This rule flags Windows file events where Inveigh-specific artefacts are created or present, based on filename suffixes for log files, configuration/input files, and Inveigh binaries/scripts. Attackers commonly use Inveigh to capture and relay authentication material, so the presence of these distinct artefacts is strong evidence of tool deployment. The detection relies on Windows file event telemetry that records target filenames and supports matching on the specified filename endings.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.