huntrule

Windows Process Creation: PingCastle Execution with Full Healthcheck Scanners

Alerts on Windows execution of PingCastle with full healthcheck and AD/security scanner command-line options.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: PingCastle Execution with Full Healthcheck Scanners"
id: 2ae1c7b8-6d1c-4134-b834-6b9a04bc90bf
related:
  - id: b37998de-a70b-4f33-b219-ec36bf433dc0
    type: derived
  - id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c
    type: derived
status: test
description: This rule flags execution of PingCastle on Windows when the process matches specific known file hashes or identifiable binary characteristics (PingCastle.exe product/original filename). It further narrows matches by requiring PingCastle command-line options that indicate a healthcheck run with full level and multiple Active Directory/security scanners. This behavior matters because recon and security assessment tooling can be used to gather domain information and validate attack paths. The rule relies on Windows process creation telemetry including file hash fields, image filename/original filename/product, and command-line arguments.
references:
  - https://github.com/vletoux/pingcastle
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450
  - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680
  - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699
  - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8
  - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_pingcastle.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2024-01-11
tags:
  - attack.reconnaissance
  - attack.t1595
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Hashes|contains:
        - MD5=f741f25ac909ee434e50812d436c73ff
        - MD5=d40acbfc29ee24388262e3d8be16f622
        - MD5=01bb2c16fadb992fa66228cd02d45c60
        - MD5=9e1b18e62e42b5444fc55b51e640355b
        - MD5=b7f8fe33ac471b074ca9e630ba0c7e79
        - MD5=324579d717c9b9b8e71d0269d13f811f
        - MD5=63257a1ddaf83cfa43fe24a3bc06c207
        - MD5=049e85963826b059c9bac273bb9c82ab
        - MD5=ecb98b7b4d4427eb8221381154ff4cb2
        - MD5=faf87749ac790ec3a10dd069d10f9d63
        - MD5=f296dba5d21ad18e6990b1992aea8f83
        - MD5=93ba94355e794b6c6f98204cf39f7a11
        - MD5=a258ef593ac63155523a461ecc73bdba
        - MD5=97000eb5d1653f1140ee3f47186463c4
        - MD5=95eb317fbbe14a82bd9fdf31c48b8d93
        - MD5=32fe9f0d2630ac40ea29023920f20f49
        - MD5=a05930dde939cfd02677fc18bb2b7df5
        - MD5=124283924e86933ff9054a549d3a268b
        - MD5=ceda6909b8573fdeb0351c6920225686
        - MD5=60ce120040f2cd311c810ae6f6bbc182
        - MD5=2f10cdc5b09100a260703a28eadd0ceb
        - MD5=011d967028e797a4c16d547f7ba1463f
        - MD5=2da9152c0970500c697c1c9b4a9e0360
        - MD5=b5ba72034b8f44d431f55275bace9f8b
        - MD5=d6ed9101df0f24e27ff92ddab42dacca
        - MD5=3ed3cdb6d12aa1ac562ad185cdbf2d1d
        - MD5=5e083cd0143ae95a6cb79b68c07ca573
        - MD5=28caff93748cb84be70486e79f04c2df
        - MD5=9d4f12c30f9b500f896efd1800e4dd11
        - MD5=4586f7dd14271ad65a5fb696b393f4c0
        - MD5=86ba9dddbdf49215145b5bcd081d4011
        - MD5=9dce0a481343874ef9a36c9a825ef991
        - MD5=85890f62e231ad964b1fda7a674747ec
        - MD5=599be548da6441d7fe3e9a1bb8cb0833
        - MD5=9b0c7fd5763f66e9b8c7b457fce53f96
        - MD5=32d45718164205aec3e98e0223717d1d
        - MD5=6ff5f373ee7f794cd17db50704d00ddb
        - MD5=88efbdf41f0650f8f58a3053b0ca0459
        - MD5=ef915f61f861d1fb7cbde9afd2e7bd93
        - MD5=781fa16511a595757154b4304d2dd350
        - MD5=5018ec39be0e296f4fc8c8575bfa8486
        - MD5=f4a84d6f1caf0875b50135423d04139f
        - SHA1=9c1431801fa6342ed68f047842b9a11778fc669b
        - SHA1=c36c862f40dad78cb065197aad15fef690c262f2
        - SHA1=bc8e23faea8b3c537f268b3e81d05b937012272d
        - SHA1=12e0357658614ff60d480d1a6709be68a2e40c5f
        - SHA1=18b33ab5719966393d424a3edbfa8dec225d98fa
        - SHA1=f14c9633040897d375e3069fddc71e859f283778
        - SHA1=08041b426c9f112ad2061bf3c8c718e34739d4fc
        - SHA1=7be77c885d0c9a4af4cecc64d512987cf93ba937
        - SHA1=72dbb719b05f89d9d2dbdf186714caf7639daa36
        - SHA1=5b1498beb2cfb4d971e377801e7abce62c0e315b
        - SHA1=292629c6ab33bddf123d26328025e2d157d9e8fc
        - SHA1=be59e621e83a2d4c87b0e6c69a2d22f175408b11
        - SHA1=0250ce9a716ab8cca1c70a9de4cbc49a51934995
        - SHA1=607e1fa810c799735221a609af3bfc405728c02d
        - SHA1=ab1c547f6d1c07a9e0a01e46adea3aae1cac12e3
        - SHA1=044cf5698a8e6b0aeba5acb56567f06366a9a70a
        - SHA1=ef2dea8c736d49607832986c6c2d6fdd68ba6491
        - SHA1=efffc2bfb8af2e3242233db9a7109b903fc3f178
        - SHA1=5a05d4320de9afbc84de8469dd02b3a109efb2d4
        - SHA1=a785d88cf8b862a420b9be793ee6a9616aa94c84
        - SHA1=5688d56cbaf0d934c4e37b112ba257e8fb63f4ea
        - SHA1=5cd2ada1c26815fbfd6a0cd746d5d429c0d83a17
        - SHA1=81d67b3d70c4e855cb11a453cc32997517708362
        - SHA1=9cffce9de95e0109f4dfecce0ab2cb0a59cc58ad
        - SHA1=09c6930d057f49c1c1e11cf9241fffc8c12df3a2
        - SHA1=e27bf7db8d96db9d4c8a06ee5e9b8e9fcb86ac92
        - SHA1=9e3c992415e390f9ada4d15c693b687f38a492d1
        - SHA1=3f34a5ee303d37916584c888c4928e1c1164f92a
        - SHA1=ea4c8c56a8f5c90a4c08366933e5fb2de611d0db
        - SHA1=3150f14508ee4cae19cf09083499d1cda8426540
        - SHA1=036ad9876fa552b1298c040e233d620ea44689c6
        - SHA1=3a3c1dcb146bb4616904157344ce1a82cd173bf5
        - SHA1=6230d6fca973fa26188dfbadede57afb4c15f75c
        - SHA1=8f7b2a9b8842f339b1e33602b7f926ab65de1a4d
        - SHA1=a586bb06b59a4736a47abff8423a54fe8e2c05c4
        - SHA1=c82152cddf9e5df49094686531872ecd545976db
        - SHA1=04c39ffc18533100aaa4f9c06baf2c719ac94a61
        - SHA1=e082affa5cdb2d46452c6601a9e85acb8446b836
        - SHA1=a075bfb6cf5c6451ce682197a87277c8bc188719
        - SHA1=34c0c5839af1c92bce7562b91418443a2044c90d
        - SHA1=74e10a9989e0ec8fe075537ac802bd3031ae7e08
        - SHA1=3a515551814775df0ccbe09f219bc972eae45a10
        - SHA256=90fd5b855b5107e7abaaefb6e658f50d5d6e08ac28e35f31d8b03dcabf77872b
        - SHA256=5836c24f233f77342fee825f3cad73caab7ab4fb65ec2aec309fd12bc1317e85
        - SHA256=e850e54b12331249c357a20604281b9abf8a91e6f3d957463fc625e6b126ef03
        - SHA256=9e752f29edcd0db9931c20b173eee8d4d8196f87382c68a6e7eb4c8a44d58795
        - SHA256=7a8c127d6c41f80d178d2315ed2f751ac91b1cd54d008af13680e04f068f426f
        - SHA256=9f65e1c142c4f814e056a197a2241fd09e09acf245c62897109871137321a72a
        - SHA256=c9b52d03c66d54d6391c643b3559184b1425c84a372081ec2bfed07ebf6af275
        - SHA256=1b96f6218498aa6baf6f6c15b8f99e542077e33feb1ab5472bbbf7d4de43eb6b
        - SHA256=768021fc242054decc280675750dec0a9e74e764b8646864c58756fa2386d2a2
        - SHA256=1e1b32bef31be040f0f038fcb5a2d68fb192daaef23c6167f91793d21e06ebae
        - SHA256=606bd75ed9d2d6107ea7ee67063d1761a99f2fb5e932c8344d11395d24587dd6
        - SHA256=b489d3cdd158f040322ae5c8d0139ad28eff743c738a10f2d0255c7e149bd92a
        - SHA256=ca7ecf04a8ad63aff330492c15270d56760cb223a607cdb1431fb00e1b9985d1
        - SHA256=9dc4fca72463078b70f6516559a179c78400b06534e63ee12fb38adbe2632559
        - SHA256=c00d2aee59bac087d769e09b5b7f832176f7714fefdc6af2502e6031e3eb37c2
        - SHA256=a8e96d564687064190eaf865774f773def05fdbf651aa5bbf66216c077b863ef
        - SHA256=84ed328cee2a0505e87662faf6fc57915e3a831c97ee88ad691f5c63522e139d
        - SHA256=c143de99c57965d3a44c1fce6a97c2773b050609c1ea7f45688a4ca2422a5524
        - SHA256=01d1efd5e552c59baa70c0778902233c05fde7de6e5cc156c62607df0804d36b
        - SHA256=9a8dfeb7e3174f3510691e2b32d0f9088e0ed67d9ed1b2afbe450d70dec2016b
        - SHA256=63b92a114075d855f706979d50ed3460fe39f8a2f5498b7657f0d14865117629
        - SHA256=2eb014130ff837b6481c26f0d0152f84de22ca7370b15a4f51921e0054a2a358
        - SHA256=7d5bb4271bf8ca2b63a59e731f3ec831dbda53adb8e28665e956afb4941f32ca
        - SHA256=e57098a75bf32e127c214b61bfba492d6b209e211f065fcc84ff10637a2143ea
        - SHA256=dd14dbcdbcfcf4bc108a926b9667af4944a3b6faf808cf1bb9a3a2554722e172
        - SHA256=dca2b1b824cb28bd15577eace45bde7ff8f8f44705b17085524659de31761de4
        - SHA256=8b95f339a07d59a8c8d8580283dffb9e8dfabdeb9171e42c948ab68c71afe7f2
        - SHA256=5428a840fab6ac4a0ecb2fc20dbc5f928432b00b9297dd1cb6e69336f44eba66
        - SHA256=e2517ae0fccaa4aefe039026a4fc855964f0c2a5f84177140200b0e58ddbfd27
        - SHA256=75d05880de2593480254181215dd9a0075373876f2f4a2a4a9a654b2e0729a41
        - SHA256=56490e14ce3817c3a1ddc0d97b96e90d6351bcd29914e7c9282f6a998cca84b1
        - SHA256=f25d0a5e77e4ed9e7c4204a33cfc8e46281b43adbee550b15701dd00f41bdbe0
        - SHA256=845a5fdcbb08e7efa7e0eabfcd881c9eebc0eec0a3a2f8689194e6b91b6eeaf8
        - SHA256=9a89e6652e563d26a3f328ba23d91f464c9549da734557c5a02559df24b2700d
        - SHA256=5614f2bc9b2ed414aab2c5c7997bdcbe8236e67ced8f91a63d1b6cfbe6e08726
        - SHA256=37bf92dcedb47a90d8d38ebda8d8dd168ef5803dcb01161f8cf6d68b70d49d90
        - SHA256=ec8590f91f5cc21e931c57345425f0625a6e37dfba026b222260450de40459f5
        - SHA256=3994eb72b1c227c593e14b8cad7001de11d1c247d4fbf84d0714bb8a17853140
        - SHA256=d654f870436d63c9d8e4390d9d4d898abdf0456736c7654d71cdf81a299c3f87
        - SHA256=63fbfabd4d8afb497dee47d112eb9d683671b75a8bf6407c4bd5027fd211b892
        - SHA256=47028053f05188e6a366fff19bedbcad2bc4daba8ff9e4df724b77d0181b7054
        - SHA256=7c1b1e8c880a30c43b3a52ee245f963a977e1f40284f4b83f4b9afe3821753dd
    - Image|endswith: \PingCastle.exe
    - OriginalFileName: PingCastle.exe
    - Product: Ping Castle
    - CommandLine|contains:
        - --scanner aclcheck
        - --scanner antivirus
        - --scanner computerversion
        - --scanner foreignusers
        - --scanner laps_bitlocker
        - --scanner localadmin
        - --scanner nullsession
        - --scanner nullsession-trust
        - --scanner oxidbindings
        - --scanner remote
        - --scanner share
        - --scanner smb
        - --scanner smb3querynetwork
        - --scanner spooler
        - --scanner startup
        - --scanner zerologon
    - CommandLine|contains: --no-enum-limit
    - CommandLine|contains|all:
        - --healthcheck
        - --level Full
    - CommandLine|contains|all:
        - --healthcheck
        - "--server "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags execution of PingCastle on Windows when the process matches specific known file hashes or identifiable binary characteristics (PingCastle.exe product/original filename). It further narrows matches by requiring PingCastle command-line options that indicate a healthcheck run with full level and multiple Active Directory/security scanners. This behavior matters because recon and security assessment tooling can be used to gather domain information and validate attack paths. The rule relies on Windows process creation telemetry including file hash fields, image filename/original filename/product, and command-line arguments.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.