Windows Inveigh HackTool Execution Artefacts via Inveigh File Indicators
Alert on Windows file creation or presence of Inveigh log, script, and binary artefacts identified by distinctive filename suffixes.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-24
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies Windows hosts where Inveigh execution-related files are present by matching specific dropped artefact filenames. Adversaries may use Inveigh to perform credential-related network activities, and the creation of recognizable log and tool files can indicate deployment. Telemetry relies on Windows file event logs that capture filenames matching Inveigh-*.txt and Inveigh tool binaries/scripts (.dll, .exe, .ps1).
Reporting behind it
- github.comhttps://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs
- github.comhttps://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs
- thedfirreport.comhttps://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_inveigh_artefacts.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Inveigh HackTool Execution Artefacts via Inveigh File Indicators
id: a9119f9f-87f0-44bd-8ec5-e4b30779aa5e
status: test
description: This rule identifies Windows hosts where Inveigh execution-related files are present by matching specific dropped artefact filenames. Adversaries may use Inveigh to perform credential-related network activities, and the creation of recognizable log and tool files can indicate deployment. Telemetry relies on Windows file event logs that capture filenames matching Inveigh-*.txt and Inveigh tool binaries/scripts (.dll, .exe, .ps1).
references:
- https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs
- https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs
- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_inveigh_artefacts.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-24
modified: 2024-06-27
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith:
- \Inveigh-Log.txt
- \Inveigh-Cleartext.txt
- \Inveigh-NTLMv1Users.txt
- \Inveigh-NTLMv2Users.txt
- \Inveigh-NTLMv1.txt
- \Inveigh-NTLMv2.txt
- \Inveigh-FormInput.txt
- \Inveigh.dll
- \Inveigh.exe
- \Inveigh.ps1
- \Inveigh-Relay.ps1
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: bb09dd3e-2b78-4819-8e35-a7c1b874e449
type: derived