huntrule

Windows: Inveigh MITM Tool Execution via Inveigh.exe Flags

Detects execution of Inveigh.exe on Windows with spoofing/sniffing command-line flags consistent with MITM behavior.

FreeUnreviewedSigmacriticalv1
title: "Windows: Inveigh MITM Tool Execution via Inveigh.exe Flags"
id: f9edb79f-5431-42b7-8af6-bf973de293c9
status: test
description: This rule flags process creation events where Inveigh executables or related files are launched and the command line includes Inveigh-specific options. These options indicate network spoofing and reply/sniffing configuration commonly used for man-in-the-middle credential capture. Detection relies on Windows process creation telemetry including executable path metadata, file description/original filename, and command-line arguments.
references:
  - https://github.com/Kevin-Robertson/Inveigh
  - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_inveigh.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-24
modified: 2023-02-04
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \Inveigh.exe
    - OriginalFileName:
        - \Inveigh.exe
        - \Inveigh.dll
    - Description: Inveigh
    - CommandLine|contains:
        - " -SpooferIP"
        - " -ReplyToIPs "
        - " -ReplyToDomains "
        - " -ReplyToMACs "
        - " -SnifferIP"
  condition: selection
falsepositives:
  - Very unlikely
level: critical
license: DRL-1.1
related:
  - id: b99a1518-1ad5-4f65-bc95-1ffff97a8fd0
    type: derived

What it detects

This rule flags process creation events where Inveigh executables or related files are launched and the command line includes Inveigh-specific options. These options indicate network spoofing and reply/sniffing configuration commonly used for man-in-the-middle credential capture. Detection relies on Windows process creation telemetry including executable path metadata, file description/original filename, and command-line arguments.

Known false positives

  • Very unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.