HackTool - winPEAS Execution
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (ORIGINALFILENAME = "winPEAS.exe" OR PROCESSNAME endswith "\winPEASany_ofs.exe,\winPEASany.exe,\winPEASx64_ofs.exe,\winPEASx64.exe,\winPEASx86_ofs.exe,\winPEASx86.exe") OR COMMANDLINE contains " applicationsinfo, browserinfo, eventsinfo, fileanalysis, filesinfo, processinfo, servicesinfo, windowscreds" OR COMMANDLINE contains "https://github.com/carlospolop/PEASS-ng/releases/latest/download/" OR (PARENTPROCESSCOMMANDLINE endswith " -linpeas" OR COMMANDLINE endswith " -linpeas") select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Georg Lauenstein (sure[secure])
