Suspicious PUA - Process Hacker Execution (via process_creation)

title: Suspicious PUA - Process Hacker Execution (via process_creation)
id: 5a345a92-04db-55b2-ba45-b94d516dcac1
status: stable
description: This rule detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors misused older vulnerable versions to manipulate system processes.
references:
    - https://attack.mitre.org/techniques/T1543/
    - https://attack.mitre.org/techniques/T1564/
    - https://attack.mitre.org/techniques/T1622/
    - https://processhacker.sourceforge.io/
    - https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/
author: Huntrule Team
date: 2026-07-22
tags:
    - attack.discovery
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1622
    - attack.t1564
    - attack.t1543
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|contains: '\ProcessHacker_'
        - Image|endswith: '\ProcessHacker.exe'
        - OriginalFileName:
              - 'ProcessHacker.exe'
              - 'Process Hacker'
        - Description: 'Process Hacker'
        - Product: 'Process Hacker'
        - Hashes|contains:
              - 'MD5=68F9B52895F4D34E74112F3129B3B00D'
              - 'MD5=B365AF317AE730A67C936F21432B9C71'
              - 'SHA1=A0BDFAC3CE1880B32FF9B696458327CE352E3B1D'
              - 'SHA1=C5E2018BF7C0F314FED4FD7FE7E69FA2E648359E'
              - 'SHA256=D4A0FE56316A2C45B9BA9AC1005363309A3EDC7ACF9E4DF64D326A0FF273E80F'
              - 'SHA256=BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4'
              - 'IMPHASH=3695333C60DEDECDCAFF1590409AA462'
              - 'IMPHASH=04DE0AD9C37EB7BD52043D2ECAC958DF'
    condition: selection
falsepositives:
    - Unknown
level: medium