{"id":"77564cc2-7382-438b-a7f6-395c2ae53b9a","title":"Remote Thread Created In KeePass.EXE","description":"Detects remote thread creation in \"KeePass.exe\" which could indicates potential password dumping activity","author":"Timon Hackenjos","status":"test","level":"high","date":"2022-04-22","modified":"2023-05-05","tags":["attack.credential-access","attack.t1555.005"],"technique_ids":["T1555.005"],"logsource":{"product":"windows","category":"create_remote_thread"},"falsepositives":["Unknown"],"references":["https://www.cisa.gov/uscert/ncas/alerts/aa20-259a","https://github.com/denandz/KeeFarce","https://github.com/GhostPack/KeeThief"],"source_path":"rules/windows/create_remote_thread/create_remote_thread_win_keepass.yml","source_sha256":"ef37cb17b8f6717b7115670cb9d5cca278164d1d4a31b52920ad55f32a1d32cf","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/create_remote_thread/create_remote_thread_win_keepass.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Remote Thread Created In KeePass.EXE\nid: 77564cc2-7382-438b-a7f6-395c2ae53b9a\nstatus: test\ndescription: Detects remote thread creation in \"KeePass.exe\" which could indicates potential password dumping activity\nreferences:\n    - https://www.cisa.gov/uscert/ncas/alerts/aa20-259a\n    - https://github.com/denandz/KeeFarce\n    - https://github.com/GhostPack/KeeThief\nauthor: Timon Hackenjos\ndate: 2022-04-22\nmodified: 2023-05-05\ntags:\n    - attack.credential-access\n    - attack.t1555.005\nlogsource:\n    product: windows\n    category: create_remote_thread\ndetection:\n    selection:\n        TargetImage|endswith: '\\KeePass.exe'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1555.005","id":"T1555.005","name":"Password Managers","page":"techniques/enterprise/T1555.005/"}],"data_path":"data/detection-rules/77564cc2-7382-438b-a7f6-395c2ae53b9a.json","kind":"sigma"}