Hacktool - WinPEAS Execution Patterns
This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. The rule looks for common WinPEAS executable names, specific command-line arguments used by WinPEAS for various enumeration tasks, and patterns indicative of downloading WinPEAS PowerShell scripts from GitHub.
YARA-L
