huntrule

Windows Hacktool Execution via PE Company Metadata (Cube0x0)

Flags execution of Windows binaries with PE Company metadata set to "Cube0x0", even when renamed.

FreeUnreviewedSigmahighv1
title: Windows Hacktool Execution via PE Company Metadata (Cube0x0)
id: f2de78d5-9388-4333-a1a1-f77d9971d5f9
status: test
description: This rule identifies process creation events where the executed file’s PE metadata contains the Company value "Cube0x0". Attackers can rename binaries to evade filename-based detections, so matching on embedded PE header fields helps catch tool execution regardless of the on-disk name. The detection relies on process creation telemetry that includes extracted PE metadata fields.
references:
  - https://github.com/cube0x0
  - https://www.virustotal.com/gui/search/metadata%253ACube0x0/files
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_execution_via_pe_metadata.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-27
modified: 2024-01-15
tags:
  - attack.credential-access
  - attack.resource-development
  - attack.t1588.002
  - attack.t1003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Company: Cube0x0
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 37c1333a-a0db-48be-b64b-7393b2386e3b
    type: derived

What it detects

This rule identifies process creation events where the executed file’s PE metadata contains the Company value "Cube0x0". Attackers can rename binaries to evade filename-based detections, so matching on embedded PE header fields helps catch tool execution regardless of the on-disk name. The detection relies on process creation telemetry that includes extracted PE metadata fields.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.