{"id":"fca949cc-79ca-446e-8064-01aa7e52ece5","title":"HackTool - PCHunter Execution","description":"Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","status":"test","level":"high","date":"2022-10-10","modified":"2024-11-23","tags":["attack.execution","attack.discovery","attack.t1082","attack.t1057","attack.t1012","attack.t1083","attack.t1007"],"technique_ids":["T1007","T1012","T1057","T1082","T1083"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://web.archive.org/web/20231210115125/http://www.xuetr.com/","https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/","https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","source_sha256":"c017c7f9b000c23c67c32d7c6a8d3ae7403983ad8e266b9d2b14cf79dd0a1a09","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - PCHunter Execution\nid: fca949cc-79ca-446e-8064-01aa7e52ece5\nstatus: test\ndescription: Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff\nreferences:\n    - https://web.archive.org/web/20231210115125/http://www.xuetr.com/\n    - https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/\n    - https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali\ndate: 2022-10-10\nmodified: 2024-11-23\ntags:\n    - attack.execution\n    - attack.discovery\n    - attack.t1082\n    - attack.t1057\n    - attack.t1012\n    - attack.t1083\n    - attack.t1007\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        Image|endswith:\n            - '\\PCHunter64.exe'\n            - '\\PCHunter32.exe'\n    selection_pe:\n        - OriginalFileName: 'PCHunter.exe'\n        - Description: 'Epoolsoft Windows Information View Tools'\n    selection_hashes:\n        Hashes|contains:\n            - 'SHA1=5F1CBC3D99558307BC1250D084FA968521482025'\n            - 'MD5=987B65CD9B9F4E9A1AFD8F8B48CF64A7'\n            - 'SHA256=2B214BDDAAB130C274DE6204AF6DBA5AEEC7433DA99AA950022FA306421A6D32'\n            - 'IMPHASH=444D210CEA1FF8112F256A4997EED7FF'\n            - 'SHA1=3FB89787CB97D902780DA080545584D97FB1C2EB'\n            - 'MD5=228DD0C2E6287547E26FFBD973A40F14'\n            - 'SHA256=55F041BF4E78E9BFA6D4EE68BE40E496CE3A1353E1CA4306598589E19802522C'\n            - 'IMPHASH=0479F44DF47CFA2EF1CCC4416A538663'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1007","id":"T1007","name":"System Service Discovery","page":"techniques/enterprise/T1007/"},{"key":"enterprise/T1012","id":"T1012","name":"Query Registry","page":"techniques/enterprise/T1012/"},{"key":"enterprise/T1057","id":"T1057","name":"Process Discovery","page":"techniques/enterprise/T1057/"},{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"},{"key":"enterprise/T1083","id":"T1083","name":"File and Directory Discovery","page":"techniques/enterprise/T1083/"}],"data_path":"data/detection-rules/fca949cc-79ca-446e-8064-01aa7e52ece5.json","kind":"sigma"}