Windows: Detect winPEAS privilege escalation reconnaissance execution
Flags Windows executions of winPEAS/PEASS-ng based on image name and command-line discovery options and release download indicators.
- Product
- windows
- Category
- process_creation
- Author
- Georg Lauenstein (sure[secure]) (SigmaHQ), DRL 1.1
- Published
- 2022-09-19
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where the executable name matches winPEAS variants (winPEAS.exe and common WinPEASany/x64/x86 filenames) and the command line indicates common WinPEAS reconnaissance options (e.g., applicationsinfo, browserinfo, eventsinfo, fileanalysis, filesinfo, processinfo, servicesinfo, windowscreds). It also matches execution paths where the downloaded payload URL for PEASS-ng is present, and where command-line arguments end with "-linpeas" in either the parent or the current process. Such behavior matters because attackers often use WinPEAS to enumerate system and credential-related artifacts to find paths for privilege escalation. The detection relies on Windows process creation telemetry, specifically image path and command-line contents, including parent command line where available.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect winPEAS privilege escalation reconnaissance execution"
id: 230d6fa5-77fc-499e-8001-845655184a66
status: test
description: This rule flags process creation where the executable name matches winPEAS variants (winPEAS.exe and common WinPEASany/x64/x86 filenames) and the command line indicates common WinPEAS reconnaissance options (e.g., applicationsinfo, browserinfo, eventsinfo, fileanalysis, filesinfo, processinfo, servicesinfo, windowscreds). It also matches execution paths where the downloaded payload URL for PEASS-ng is present, and where command-line arguments end with "-linpeas" in either the parent or the current process. Such behavior matters because attackers often use WinPEAS to enumerate system and credential-related artifacts to find paths for privilege escalation. The detection relies on Windows process creation telemetry, specifically image path and command-line contents, including parent command line where available.
references:
- https://github.com/carlospolop/PEASS-ng
- https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_winpeas.yml
author: Georg Lauenstein (sure[secure]), Huntrule Team
date: 2022-09-19
modified: 2023-03-23
tags:
- attack.privilege-escalation
- attack.discovery
- attack.t1082
- attack.t1087
- attack.t1046
logsource:
category: process_creation
product: windows
detection:
selection_img:
- OriginalFileName: winPEAS.exe
- Image|endswith:
- \winPEASany_ofs.exe
- \winPEASany.exe
- \winPEASx64_ofs.exe
- \winPEASx64.exe
- \winPEASx86_ofs.exe
- \winPEASx86.exe
selection_cli_option:
CommandLine|contains:
- " applicationsinfo"
- " browserinfo"
- " eventsinfo"
- " fileanalysis"
- " filesinfo"
- " processinfo"
- " servicesinfo"
- " windowscreds"
selection_cli_dl:
CommandLine|contains: https://github.com/carlospolop/PEASS-ng/releases/latest/download/
selection_cli_specific:
- ParentCommandLine|endswith: " -linpeas"
- CommandLine|endswith: " -linpeas"
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 98b53e78-ebaf-46f8-be06-421aafd176d9
type: derived