Renamed PingCastle Binary Execution Detection
This rule detects the execution of the PingCastle utility, a legitimate Active Directory security assessment tool, when its executable name has been changed. Adversaries often rename legitimate tools to evade detection. The detection logic relies on identifying specific original file names within the PE metadata (OriginalFileName) and/or recognizing characteristic command-line arguments used by PingCastle, such as those related to scanner functions or health checks. The rule specifically filters out executions where the image path matches the original PingCastle executable names, focusing on instances where the binary has been renamed.
Sigma
