Winpeas
Description
Generated datasets for winpeas in attack range.
MITRE ATT&CK Techniques
No MITRE techniques specified for this dataset.
Environment Details
| Field | Value |
|---|---|
| Environment | attack_range |
| Directory | winpeas |
| Test Date | 2022-12-01 |
Datasets
The following datasets were collected during this attack simulation:
Sysmon
- Path:
/datasets/malware/winpeas/sysmon.log - Sourcetype:
XmlWinEventLog - Source:
XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Related Detections
The following detections in our security content repository use this attack data for testing:
| Detection Name | Type | Source | MITRE ATT&CK | Analytic Story |
|---|---|---|---|---|
| Windows WMI Process And Service List | Anomaly |
Endpoint | T1047 | Windows Post-Exploitation, Prestige Ransomware |
| Windows Steal or Forge Kerberos Tickets Klist | Hunting |
Endpoint | T1558 | Windows Post-Exploitation, Prestige Ransomware |
| Windows System Network Config Discovery Display DNS | Anomaly |
Endpoint | T1016 | Medusa Ransomware, Windows Post-Exploitation, Prestige Ransomware, Water Gamayun |
| Windows Registry Entries Exported Via Reg | Hunting |
Endpoint | T1012 | Windows Post-Exploitation, CISA AA23-347A, Prestige Ransomware |
| Windows System User Discovery Via Quser | Hunting |
Endpoint | T1033 | Prestige Ransomware, Crypto Stealer, Windows Post-Exploitation |
| Windows Cached Domain Credentials Reg Query | Anomaly |
Endpoint | T1003.005 | Windows Post-Exploitation, Prestige Ransomware |
| Windows Registry Entries Restored Via Reg | Hunting |
Endpoint | T1012 | Windows Post-Exploitation, Prestige Ransomware |
| Windows Security Support Provider Reg Query | Anomaly |
Endpoint | T1547.005 | Windows Post-Exploitation, Prestige Ransomware, Sneaky Active Directory Persistence Tricks |
| Windows Indirect Command Execution Via Series Of Forfiles | Anomaly |
Endpoint | T1202 | Windows Post-Exploitation, Prestige Ransomware |
| Windows System Network Connections Discovery Netsh | Anomaly |
Endpoint | T1049 | Windows Post-Exploitation, Prestige Ransomware, Snake Keylogger |
| Windows Information Discovery Fsutil | Anomaly |
Endpoint | T1082 | Windows Post-Exploitation, Prestige Ransomware |
| Windows Credentials in Registry Reg Query | Anomaly |
Endpoint | T1552.002 | Windows Post-Exploitation, Prestige Ransomware |
| Windows Credentials from Password Stores Query | Anomaly |
Endpoint | T1555 | Windows Post-Exploitation, Prestige Ransomware, DarkGate Malware |
| Windows ClipBoard Data via Get-ClipBoard | Anomaly |
Endpoint | T1115 | Windows Post-Exploitation, Prestige Ransomware |
| Windows Private Keys Discovery | Anomaly |
Endpoint | T1552.004 | Windows Post-Exploitation, Prestige Ransomware |
| Windows Password Managers Discovery | Anomaly |
Endpoint | T1555.005 | Windows Post-Exploitation, Prestige Ransomware, Scattered Spider, Scattered Lapsus$ Hunters |
Usage Instructions
Replay with Splunk Attack Data
Replay attack data with replay.py from Splunk Attack Data.
1python replay.py --dataset /datasets/malware/winpeas/sysmon.log --index attack_data
Manual Import
- Download the dataset files from the paths listed above
- Configure your Splunk instance with the appropriate sourcetypes
- Import the logs using the Splunk Add Data wizard
Related Content
Find more detections and analytics for this attack technique in our security content repository.
Source: GitHub | Version: 1.0