huntrule

Windows Process Creation alerts on GALLIUM-associated hash IOCs

Flags Windows process executions where the file hash matches hardcoded GALLIUM-associated SHA256/SHA1 IOCs.

FreeReviewedSigma · High · v5
Product
windows
Category
process_creation
Author
Tim Burrell (SigmaHQ), DRL 1.1
Published
2020-02-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events when the process image hash matches a set of GALLIUM-associated SHA256 or SHA1 indicators. Attackers may reuse known malware components or tooling that produces identifiable hashes across infections, making hash-based matching a fast way to surface suspicious activity. The detection relies on process creation telemetry that includes process file hashes (SHA256 and/or SHA1) and compares them to the provided IOC list.

Reporting behind it

Related detections9 linkedT1071 — drag to rearrange
Suspicious SSH Service on Non Standard Port 57722
Suspicious Bash Reverse Shell via /dev/tcp
Windows GitHub Self-Hosted Runner Execution via Runner.Worker and Runner.Listener
macOS Installer Scripts Spawning Suspicious Interpreter Child Processes
Windows Rundll32 Calls DavSetCookie for NTLM Coercion via Spoolss/Srvsvc
Apache Guacamole Linux: Two-User Session Presence Anomaly
Windows DNS analytic events for GALLIUM-related ddns QNAMEs (EventID 257)
Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)
Windows Process Execution Matching SILENTTRINITY Stager Metadata (st2stager)
Windows Process Creation alerts on GALLIUM-associated hash IOCs
Pivot detection · T1071 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.