PUA - PingCastle Execution
This rule detects the execution of PingCastle, a legitimate tool used for auditing Active Directory security. Adversaries often leverage such tools during the reconnaissance phase to gather information about the target environment, specifically Active Directory configurations, user accounts, and potential vulnerabilities. The rule identifies PingCastle execution by matching specific MD5, SHA1, and SHA256 hashes of the executable, its original filename, product name, and various command-line arguments associated with its scanning functionalities.
Sigma
