{"id":"811e0002-b13b-4a15-9d00-a613fce66e42","title":"PUA - Process Hacker Execution","description":"Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).\nProcess Hacker is a tool to view and manipulate processes, kernel options and other low level options.\nThreat actors abused older vulnerable versions to manipulate system processes.\n","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-10-10","modified":"2024-11-23","tags":["attack.discovery","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1622","attack.t1564","attack.t1543"],"technique_ids":["T1543","T1564","T1622"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["While sometimes 'Process Hacker is used by legitimate administrators, the execution of Process Hacker must be investigated and allowed on a case by case basis"],"references":["https://processhacker.sourceforge.io/","https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_process_hacker.yml","source_sha256":"72800819b01116eaee1ec3394005e249145bc3d97515411be6ff165a3a42187f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_process_hacker.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - Process Hacker Execution\nid: 811e0002-b13b-4a15-9d00-a613fce66e42\nrelated:\n    - id: 5722dff1-4bdd-4949-86ab-fbaf707e767a\n      type: similar\nstatus: test\ndescription: |\n    Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).\n    Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.\n    Threat actors abused older vulnerable versions to manipulate system processes.\nreferences:\n    - https://processhacker.sourceforge.io/\n    - https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-10-10\nmodified: 2024-11-23\ntags:\n    - attack.discovery\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1622\n    - attack.t1564\n    - attack.t1543\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Image|contains: '\\ProcessHacker_'\n        - Image|endswith: '\\ProcessHacker.exe'\n        - OriginalFileName:\n              - 'ProcessHacker.exe'\n              - 'Process Hacker'\n        - Description: 'Process Hacker'\n        - Product: 'Process Hacker'\n        - Hashes|contains:\n              - 'MD5=68F9B52895F4D34E74112F3129B3B00D'\n              - 'MD5=B365AF317AE730A67C936F21432B9C71'\n              - 'SHA1=A0BDFAC3CE1880B32FF9B696458327CE352E3B1D'\n              - 'SHA1=C5E2018BF7C0F314FED4FD7FE7E69FA2E648359E'\n              - 'SHA256=D4A0FE56316A2C45B9BA9AC1005363309A3EDC7ACF9E4DF64D326A0FF273E80F'\n              - 'SHA256=BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4'\n              - 'IMPHASH=3695333C60DEDECDCAFF1590409AA462'\n              - 'IMPHASH=04DE0AD9C37EB7BD52043D2ECAC958DF'\n    condition: selection\nfalsepositives:\n    - While sometimes 'Process Hacker is used by legitimate administrators, the execution of Process Hacker must be investigated and allowed on a case by case basis\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1543","id":"T1543","name":"Create or Modify System Process","page":"techniques/enterprise/T1543/"},{"key":"enterprise/T1564","id":"T1564","name":"Hide Artifacts","page":"techniques/enterprise/T1564/"},{"key":"enterprise/T1622","id":"T1622","name":"Debugger Evasion","page":"techniques/enterprise/T1622/"}],"data_path":"data/detection-rules/811e0002-b13b-4a15-9d00-a613fce66e42.json","kind":"sigma"}