PUA - NSudo Execution

Title: PUA - NSudo Execution
Status: test
Description:Detects the use of NSudo tool for command execution
References:
  -https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/
  -https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
Date: 2022-01-24
modified:2023-02-13
Tags:

• -'attack.execution'
• -'attack.t1569.002'
• -'attack.s0029'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\NSudo.exe'
      - '\NSudoLC.exe'
      - '\NSudoLG.exe'
    - OriginalFileName:
      - 'NSudo.exe'
      - 'NSudoLC.exe'
      - 'NSudoLG.exe'
  selection_cli:
    CommandLine|contains:
      -'-U:S '
      -'-U:T '
      -'-U:E '
      -'-P:E '
      -'-M:S '
      -'-M:H '
      -'-U=S '
      -'-U=T '
      -'-U=E '
      -'-P=E '
      -'-M=S '
      -'-M=H '
      -'-ShowWindowMode:Hide'

  condition:all of selection_*
Falsepositives:
  -Legitimate use by administrators
Level: high