Sigma rule: HackTool - Generic Process Access

Rule

Title

HackTool - Generic Process Access

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel

Date

2023-11-27

File

rules/windows/process_access/proc_access_win_hktl_generic_access.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects process access requests from hacktool processes based on their default image name

Log source

product

windows

category

process_access

Detection

selection:
    - SourceImage|endswith:
          - '\Akagi.exe'
          - '\Akagi64.exe'
          - '\atexec_windows.exe'
          - '\Certify.exe'
          - '\Certipy.exe'
          - '\CoercedPotato.exe'
          - '\crackmapexec.exe'
          - '\CreateMiniDump.exe'
          - '\dcomexec_windows.exe'
          - '\dpapi_windows.exe'
          - '\findDelegation_windows.exe'
          - '\GetADUsers_windows.exe'
          - '\GetNPUsers_windows.exe'
          - '\getPac_windows.exe'
          - '\getST_windows.exe'
          - '\getTGT_windows.exe'
          - '\GetUserSPNs_windows.exe'
          - '\gmer.exe'
          - '\hashcat.exe'
          - '\htran.exe'
          - '\ifmap_windows.exe'
          - '\impersonate.exe'
          - '\Inveigh.exe'
          - '\LocalPotato.exe'
          - '\mimikatz_windows.exe'
          - '\mimikatz.exe'
          - '\netview_windows.exe'
          - '\nmapAnswerMachine_windows.exe'
          - '\opdump_windows.exe'
          - '\PasswordDump.exe'
          - '\Potato.exe'
          - '\PowerTool.exe'
          - '\PowerTool64.exe'
          - '\psexec_windows.exe'
          - '\PurpleSharp.exe'
          - '\pypykatz.exe'
          - '\QuarksPwDump.exe'
          - '\rdp_check_windows.exe'
          - '\Rubeus.exe'
          - '\SafetyKatz.exe'
          - '\sambaPipe_windows.exe'
          - '\SelectMyParent.exe'
          - '\SharpChisel.exe'
          - '\SharPersist.exe'
          - '\SharpEvtMute.exe'
          - '\SharpImpersonation.exe'
          - '\SharpLDAPmonitor.exe'
          - '\SharpLdapWhoami.exe'
          - '\SharpUp.exe'
          - '\SharpView.exe'
          - '\smbclient_windows.exe'
          - '\smbserver_windows.exe'
          - '\sniff_windows.exe'
          - '\sniffer_windows.exe'
          - '\split_windows.exe'
          - '\SpoolSample.exe'
          - '\Stracciatella.exe'
          - '\SysmonEOP.exe'
          - '\temp\rot.exe'
          - '\ticketer_windows.exe'
          - '\TruffleSnout.exe'
          - '\winPEASany_ofs.exe'
          - '\winPEASany.exe'
          - '\winPEASx64_ofs.exe'
          - '\winPEASx64.exe'
          - '\winPEASx86_ofs.exe'
          - '\winPEASx86.exe'
          - '\xordump.exe'
    - SourceImage|contains:
          - '\goldenPac'
          - '\just_dce_'
          - '\karmaSMB'
          - '\kintercept'
          - '\LocalPotato'
          - '\ntlmrelayx'
          - '\rpcdump'
          - '\samrdump'
          - '\secretsdump'
          - '\smbexec'
          - '\smbrelayx'
          - '\wmiexec'
          - '\wmipersist'
          - 'HotPotato'
          - 'Juicy Potato'
          - 'JuicyPotato'
          - 'PetitPotam'
          - 'RottenPotato'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.credential-access
• attack.t1003.001
• attack.s0002

MITRE ATT&CK ids this rule names

• S0002
• T1003.001

References

• https://jsecurity101.medium.com/bypassing-access-mask-auditing-strategies-480fb641c158
• https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_access/proc_access_win_hktl_generic_access.yml