Known offensive tool
Flags the presence or execution of known offensive tooling (SharpHound, Mimikatz, Rubeus, Impacket, Cobalt Strike, ...) catalogued in the threat…
What it detects
Flags the presence or execution of known offensive tooling (SharpHound, Mimikatz, Rubeus, Impacket, Cobalt Strike, ...) catalogued in the threat knowledge base. This is the 'early detection' layer: the moment such a tool appears in imported evidence it is surfaced, rather than waiting for anomaly ranking. Per-tool MITRE techniques and context live in knowledge/threat-knowledge-base.yaml, which remains the SOURCE OF TRUTH for this list.
Scope: this rule carries the KB entries rated critical/high — tooling whose presence is essentially never routine administration. KB entries rated medium/low moved to execution.dual_use_admin_tool at medium severity. Nothing was dropped in that split, and no signature appears in both rules, so one event never produces two alerts. Previously every KB tool fired here at high, which meant a sanctioned MSP RMM deployment raised a high alert (twice, alongside windows.remote_access.rmm_tool_install) every time it ran.
MITRE ATT&CK mapping
- T1059Command and Scripting Interpreter· Execution
False positives and triage
A tool name can still occur in an unrelated file path, filename, or archive listing — this matches the raw message, so confirm the Image / CommandLine and the invoking user before escalating. Sanctioned purple-team or assessment activity trips this rule by design; scope it to the case and suppress with a reason rather than deleting the alert. Genuinely dual-use tooling is deliberately NOT here — see execution.dual_use_admin_tool.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/multi/known_offensive_tool.yaml, licensed under the Apache License 2.0.
id: execution.known_offensive_tool
version: 1.1.0
status: stable
severity: high
confidence: 0.7
platforms: [windows, linux, macos]
mitre_techniques: [T1059]
description: |
Flags the presence or execution of known offensive tooling (SharpHound, Mimikatz,
Rubeus, Impacket, Cobalt Strike, ...) catalogued in the threat knowledge base. This
is the 'early detection' layer: the moment such a tool appears in imported evidence
it is surfaced, rather than waiting for anomaly ranking. Per-tool MITRE techniques
and context live in knowledge/threat-knowledge-base.yaml, which remains the SOURCE
OF TRUTH for this list.
Scope: this rule carries the KB entries rated critical/high — tooling whose presence
is essentially never routine administration. KB entries rated medium/low moved to
`execution.dual_use_admin_tool` at medium severity. Nothing was dropped in that
split, and no signature appears in both rules, so one event never produces two
alerts. Previously every KB tool fired here at high, which meant a sanctioned MSP
RMM deployment raised a high alert (twice, alongside
windows.remote_access.rmm_tool_install) every time it ran.
match:
raw_message_contains_any:
# Credential Access
- "certify.exe"
- "certipy"
- "coercer"
- "dfscoerce"
- "inveigh"
- "invoke-mimikatz"
- "kerbrute"
- "lazagne"
- "lsadump"
- "lsassy"
- "mimikatz"
- "nanodump"
- "petitpotam"
- "printerbug"
- "responder.py"
- "rubeus"
- "sekurlsa"
# Defense Evasion
- "aukill"
- "backstab"
- "gmer"
- "pchunter"
- "processhacker"
- "spyboy"
- "terminator.exe"
- "terminator.sys"
# Discovery
- "bloodhound"
- "linpeas"
- "peass"
- "seatbelt"
- "sharphound"
- "sharpview"
- "winpeas"
# Execution
- "beacon.dll"
- "cobalt strike"
- "cobaltstrike"
- "demon.dll"
- "demon.x64"
- "havoc"
- "invoke-dllinjection"
- "invoke-shellcode"
- "metasploit"
- "meterpreter"
- "msfvenom"
- "powersploit"
- "powerview"
- "sliver"
- "sliverc2"
# Lateral Movement
- "atexec"
- "crackmapexec"
- "dcomexec"
- "impacket"
- "netexec"
- "nxc "
- "nxc.exe"
- "paexec"
- "psexec"
- "psexec.py"
- "psexesvc"
- "secretsdump"
- "smbexec"
- "wmiexec"
# Tunneling
- "chisel"
- "ligolo"
- "ligolo-agent"
- "ligolo-ng"
- "plink -r"
false_positive_guidance: |
A tool name can still occur in an unrelated file path, filename, or archive listing —
this matches the raw message, so confirm the Image / CommandLine and the invoking user
before escalating. Sanctioned purple-team or assessment activity trips this rule by
design; scope it to the case and suppress with a reason rather than deleting the alert.
Genuinely dual-use tooling is deliberately NOT here — see execution.dual_use_admin_tool.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.