HackTool - Impersonate Execution

Hunt Hypothesis

Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Detection Rule

Sigma (Original)

title: HackTool - Impersonate Execution
id: cf0c254b-22f1-4b2b-8221-e137b3c0af94
status: test
description: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
references:
    - https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/
    - https://github.com/sensepost/impersonate
author: Sai Prashanth Pulisetti @pulisettis
date: 2022-12-21
modified: 2024-11-23
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1134.001
    - attack.t1134.003
logsource:
    product: windows
    category: process_creation
detection:
    selection_commandline_exe:
        CommandLine|contains: 'impersonate.exe'
    selection_commandline_opt:
        CommandLine|contains:
            - ' list '
            - ' exec '
            - ' adduser '
    selection_hash:
        Hashes|contains:
            - 'MD5=9520714AB576B0ED01D1513691377D01'
            - 'SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A'
            - 'IMPHASH=0A358FFC1697B7A07D0E817AC740DF62'
    condition: all of selection_commandline_* or selection_hash
falsepositives:
    - Unknown
level: medium

KQL (Azure Sentinel)

imProcessCreate
| where (TargetProcessCommandLine contains "impersonate.exe" and (TargetProcessCommandLine contains " list " or TargetProcessCommandLine contains " exec " or TargetProcessCommandLine contains " adduser ")) or (TargetProcessMD5 startswith "9520714AB576B0ED01D1513691377D01" or TargetProcessSHA256 startswith "E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A" or TargetProcessIMPHASH startswith "0A358FFC1697B7A07D0E817AC740DF62")

Required Data Sources

False Positive Guidance

• Unknown

MITRE ATT&CK Context

• Tactic: Privilege Escalation
• Technique: T1134.001 — T1134.001
• Technique: T1134.003 — T1134.003

References

• https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/
• https://github.com/sensepost/impersonate
• SigmaHQ Rule