Windows Process Creation: WinPwn Keyword Execution in Command Line

title: "Windows Process Creation: WinPwn Keyword Execution in Command Line"
id: e16878de-4ce0-4620-963f-0cbaa5125f54
related:
  - id: 851fd622-b675-4d26-b803-14bc7baa517a
    type: similar
  - id: d557dc06-62e8-4468-a8e8-7984124908ce
    type: derived
status: test
description: This rule flags Windows process creation events whose command line contains WinPwn-specific strings such as "Offline_Winpwn", "WinPwn ", "WinPwn.exe", or "WinPwn.ps1". Attackers may use WinPwn for Windows and Active Directory reconnaissance and exploitation, and these command-line artifacts help identify tool execution. It relies on process creation telemetry with access to the full command line.
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2023-12-04
references:
  - https://github.com/S3cur3Th1sSh1t/WinPwn
  - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841
  - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
  - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md
  - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml
tags:
  - attack.credential-access
  - attack.discovery
  - attack.execution
  - attack.privilege-escalation
  - attack.t1046
  - attack.t1082
  - attack.t1106
  - attack.t1518
  - attack.t1548.002
  - attack.t1552.001
  - attack.t1555
  - attack.t1555.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - Offline_Winpwn
      - "WinPwn "
      - WinPwn.exe
      - WinPwn.ps1
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1