Add Ligolo-ng tunneling tool detection #5818
Conversation
Detects Ligolo-ng agent and proxy execution for network pivoting - MITRE ATT&CK: T1572 (Protocol Tunneling) - Covers renamed binaries via OriginalFileName field - Addresses detection gap for modern tunneling tools
github-actions
bot
added
Rules
Review Needed
swachchhanda000
left a comment
swachchhanda000
left a comment
There was a problem hiding this comment.
Hi @SecMab,
Thank you for your contribution!. keep them coming.
However, Before we start with PR review, please make sure:
- Your rule follow the sigma standard specification . You can also check related rules which are already merged on the repo.
- All automated checks and actions are passing
PSA: We also appreciate corresponding evtx log for regression test.
swachchhanda000
added
Author Input Required
frack113
left a comment
frack113
left a comment
There was a problem hiding this comment.
You have to fix your yaml to pass the workflow:
======================
= Linting YAML files =
======================
Error: /windows/process_creation/proc_creation_win_hktl_ligolo_ng.yml:19:13: [error] wrong indentation: expected 14 but found 12 (indentation)
Error: Process completed with exit code 1.
| description: Detects execution of Ligolo-ng agent or proxy, a tunneling tool commonly used for network pivoting in penetration testing and by threat actors | ||
| references: | ||
| - https://github.com/nicocha30/ligolo-ng | ||
| - https://attack.mitre.org/techniques/T1572/ |
There was a problem hiding this comment.
| - https://attack.mitre.org/techniques/T1572/ |
We use the tag for mitre in the repo as you did
| - https://github.com/nicocha30/ligolo-ng | ||
| - https://attack.mitre.org/techniques/T1572/ | ||
| author: MAB | ||
| date: 2025/12/31 |
There was a problem hiding this comment.
| date: 2025/12/31 | |
| date: 2025-12-31 |
Check the specification for more information
…ITRE URL - Fixed date format to ISO 8601 (YYYY-MM-DD) - Corrected YAML indentation errors - Removed MITRE ATT&CK URL from references - Maintained detection logic with proper structure
EVTX Samples for Regression Testing.zipAttached Sysmon Event ID 1 (Process Creation) logs from test environment. Test Scenarios Executed:
Key Findings:
Environment:
Future Improvements:
All test scenarios successfully detected by the rule. |
| - '-connect' | ||
| - '-ignore-cert' | ||
| - '-selfcert' |
There was a problem hiding this comment.
many tools use that type of cli option.
You can not have a high rule with many FP.
Look at https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/process_creation/proc_creation_win_nltest_recon.yml as example.
| - '\agent.exe' | ||
| - '\proxy.exe' |
There was a problem hiding this comment.
| - '\agent.exe' | |
| - '\proxy.exe' |
These names are also very generic. When writing a rule about hktl,
we try to use the very specific process names, originalfilename or imphash.
In some cases, we also use command lines that may include combinations of flags or any specific strings which is unique to that specific tool only.
Please have a look at other HKTL or PUA rules on the repo for better understanding and make the changes accordingly.
Thanks
3 participants
Detects Ligolo-ng agent and proxy execution for network pivoting
Summary of the Pull Request
This PR adds detection for Ligolo-ng, a modern tunneling tool used for network pivoting. Currently, SigmaHQ has no coverage for this tool despite its widespread use in penetration testing and adoption by threat actors.
Changelog
new: Ligolo-ng Tunneling Tool Execution
Example Log Event
N/A - New detection rule (not a false positive fix)
Fixed Issues
N/A - New rule submission
SigmaHQ Rule Creation Conventions