PingCastle Execution From Suspicious Parent or Location

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•1•0•32

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level, when launched from a potentially suspicious or uncommon parent process or location. This often indicates an adversary performing reconnaissance within an Active Directory environment.