Windows HackTool Execution: Stracciatella.exe Process Identified via PE Metadata

title: "Windows HackTool Execution: Stracciatella.exe Process Identified via PE Metadata"
id: 00edb33e-e8d6-49fa-96b4-9f21f3101a6d
status: test
description: This rule flags execution of the Stracciatella hack tool on Windows by matching process creation telemetry to specific file properties. It relies on Image name/path ending with Stracciatella.exe and PE metadata fields (OriginalFileName and Description) and also validates against known SHA256 hashes. Detecting this matters because Stracciatella is designed to impair defensive instrumentation related to script and runtime visibility. The rule uses process creation events and file/PE attributes plus hash matches to keep coverage specific to this binary.
references:
  - https://github.com/mgeeky/Stracciatella
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2023-04-17
modified: 2024-11-23
tags:
  - attack.execution
  - attack.defense-impairment
  - attack.t1059
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \Stracciatella.exe
    - OriginalFileName: Stracciatella.exe
    - Description: Stracciatella
    - Hashes|contains:
        - SHA256=9d25e61ec1527e2a69d7c2a4e3fe2fe15890710c198a66a9f25d99fdf6c7b956
        - SHA256=fd16609bd9830c63b9413671678bb159b89c357d21942ddbb6b93add808d121a
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 7a4d9232-92fc-404d-8ce1-4c92e7caf539
    type: derived