WinPEAS Execution Detection
WinPEAS is a widely used privilege escalation and discovery tool. This rule detects the execution of winPEAS by monitoring process creation events for specific filenames and command-line arguments. It also looks for command-line options related to information gathering (applications, browser, events, files, processes, services, windows credentials) and attempts to download the tool from its GitHub repository. The rule aims to identify potential privilege escalation attempts and extensive system discovery activities by adversaries.
Sigma
