Windows HackTool Process Access: Detect Access by Common Tool Image Names

Alerts on Windows process access events initiated by processes whose image names match common credential/dumping hack tools.

FreeReviewedSigma · High · v2

Product: windows
Category: process_access
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
Published: 2023-11-27
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process access events on Windows where the SourceImage matches a known set of common hacktool executable names or image-path fragments. Attackers often use tools that enumerate credentials, dump process memory, or impersonate/execute under elevated contexts, which can trigger suspicious cross-process access. The detection relies on process_access telemetry that records SourceImage for the process requesting access.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Malicious Credential Dumping via Mimikatz Sekurlsa Command

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

Malicious LSASS Credential Dump via ProcDump (via process_creation)

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

Malicious LSASS Dump via Process Access (via process_access)

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

Windows HackTool Process Access: Detect Access by Common Tool Image Names

Pivot detection · T1003.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-hacktool-process-access-alerts-via-suspicious-source-image-names-d0d2f720

title: "Windows HackTool Process Access: Detect Access by Common Tool Image Names"
id: d98a6506-777e-406d-9bd9-1eb8efd1dee8
status: test
description: This rule flags process access events on Windows where the SourceImage matches a known set of common hacktool executable names or image-path fragments. Attackers often use tools that enumerate credentials, dump process memory, or impersonate/execute under elevated contexts, which can trigger suspicious cross-process access. The detection relies on process_access telemetry that records SourceImage for the process requesting access.
references:
  - https://jsecurity101.medium.com/bypassing-access-mask-auditing-strategies-480fb641c158
  - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_generic_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel, Huntrule Team
date: 2023-11-27
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0002
logsource:
  category: process_access
  product: windows
detection:
  selection:
    - SourceImage|endswith:
        - \Akagi.exe
        - \Akagi64.exe
        - \atexec_windows.exe
        - \Certify.exe
        - \Certipy.exe
        - \CoercedPotato.exe
        - \crackmapexec.exe
        - \CreateMiniDump.exe
        - \dcomexec_windows.exe
        - \dpapi_windows.exe
        - \findDelegation_windows.exe
        - \GetADUsers_windows.exe
        - \GetNPUsers_windows.exe
        - \getPac_windows.exe
        - \getST_windows.exe
        - \getTGT_windows.exe
        - \GetUserSPNs_windows.exe
        - \gmer.exe
        - \hashcat.exe
        - \htran.exe
        - \ifmap_windows.exe
        - \impersonate.exe
        - \Inveigh.exe
        - \LocalPotato.exe
        - \mimikatz_windows.exe
        - \mimikatz.exe
        - \netview_windows.exe
        - \nmapAnswerMachine_windows.exe
        - \opdump_windows.exe
        - \PasswordDump.exe
        - \Potato.exe
        - \PowerTool.exe
        - \PowerTool64.exe
        - \psexec_windows.exe
        - \PurpleSharp.exe
        - \pypykatz.exe
        - \QuarksPwDump.exe
        - \rdp_check_windows.exe
        - \Rubeus.exe
        - \SafetyKatz.exe
        - \sambaPipe_windows.exe
        - \SelectMyParent.exe
        - \SharpChisel.exe
        - \SharPersist.exe
        - \SharpEvtMute.exe
        - \SharpImpersonation.exe
        - \SharpLDAPmonitor.exe
        - \SharpLdapWhoami.exe
        - \SharpUp.exe
        - \SharpView.exe
        - \smbclient_windows.exe
        - \smbserver_windows.exe
        - \sniff_windows.exe
        - \sniffer_windows.exe
        - \split_windows.exe
        - \SpoolSample.exe
        - \Stracciatella.exe
        - \SysmonEOP.exe
        - \temp\rot.exe
        - \ticketer_windows.exe
        - \TruffleSnout.exe
        - \winPEASany_ofs.exe
        - \winPEASany.exe
        - \winPEASx64_ofs.exe
        - \winPEASx64.exe
        - \winPEASx86_ofs.exe
        - \winPEASx86.exe
        - \xordump.exe
    - SourceImage|contains:
        - \goldenPac
        - \just_dce_
        - \karmaSMB
        - \kintercept
        - \LocalPotato
        - \ntlmrelayx
        - \rpcdump
        - \samrdump
        - \secretsdump
        - \smbexec
        - \smbrelayx
        - \wmiexec
        - \wmipersist
        - HotPotato
        - Juicy Potato
        - JuicyPotato
        - PetitPotam
        - RottenPotato
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: d0d2f720-d14f-448d-8242-51ff396a334e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL