Windows PingCastle Execution From Suspicious Parent Processes
Alerts on PingCastle (PingCastle.exe) being run with full scan/healthcheck arguments from potentially suspicious parent process locations.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-01-11
- Updated
- 2026-07-30
ATT&CK techniques
ReconRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of PingCastle on Windows when it is launched by a parent process with suspicious or uncommon command-line characteristics, including script/HTML/shortcut-related extensions and user or temporary directory paths. Attackers may use PingCastle-like discovery tooling during Active Directory reconnaissance, and disguising the launch origin helps evade monitoring. The detection relies on Windows process creation telemetry fields such as Image, OriginalFileName, CommandLine, and ParentCommandLine/ParentCommandLinePath matching.
Reporting behind it
- github.comhttps://github.com/vletoux/pingcastle
- thedfirreport.comhttps://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- github.comhttps://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450
- github.comhttps://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680
- github.comhttps://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699
- github.comhttps://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8
- github.comhttps://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_pingcastle_script_parent.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-pingcastle-execution-from-suspicious-parent-processes-b37998de
title: Windows PingCastle Execution From Suspicious Parent Processes
id: eaa4628c-2210-421a-9c9a-0cdd60c6cbf4
related:
- id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c
type: derived
- id: b37998de-a70b-4f33-b219-ec36bf433dc0
type: derived
status: test
description: This rule flags execution of PingCastle on Windows when it is launched by a parent process with suspicious or uncommon command-line characteristics, including script/HTML/shortcut-related extensions and user or temporary directory paths. Attackers may use PingCastle-like discovery tooling during Active Directory reconnaissance, and disguising the launch origin helps evade monitoring. The detection relies on Windows process creation telemetry fields such as Image, OriginalFileName, CommandLine, and ParentCommandLine/ParentCommandLinePath matching.
references:
- https://github.com/vletoux/pingcastle
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450
- https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680
- https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699
- https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8
- https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_pingcastle_script_parent.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2024-01-11
tags:
- attack.reconnaissance
- attack.t1595
logsource:
category: process_creation
product: windows
detection:
selection_parent_ext:
ParentCommandLine|contains:
- .bat
- .chm
- .cmd
- .hta
- .htm
- .html
- .js
- .lnk
- .ps1
- .vbe
- .vbs
- .wsf
selection_parent_path_1:
ParentCommandLine|contains:
- :\Perflogs\
- :\Temp\
- :\Users\Public\
- :\Windows\Temp\
- \AppData\Local\Temp
- \AppData\Roaming\
- \Temporary Internet
selection_parent_path_2:
- ParentCommandLine|contains|all:
- :\Users\
- \Favorites\
- ParentCommandLine|contains|all:
- :\Users\
- \Favourites\
- ParentCommandLine|contains|all:
- :\Users\
- \Contacts\
selection_cli:
- Image|endswith: \PingCastle.exe
- OriginalFileName: PingCastle.exe
- Product: Ping Castle
- CommandLine|contains:
- --scanner aclcheck
- --scanner antivirus
- --scanner computerversion
- --scanner foreignusers
- --scanner laps_bitlocker
- --scanner localadmin
- --scanner nullsession
- --scanner nullsession-trust
- --scanner oxidbindings
- --scanner remote
- --scanner share
- --scanner smb
- --scanner smb3querynetwork
- --scanner spooler
- --scanner startup
- --scanner zerologon
- CommandLine|contains: --no-enum-limit
- CommandLine|contains|all:
- --healthcheck
- --level Full
- CommandLine|contains|all:
- --healthcheck
- "--server "
condition: 1 of selection_parent_* and selection_parent_ext and selection_cli
falsepositives:
- Unknown
level: high
license: DRL-1.1