Windows Process Creation: nimgrab.exe Execution (Nim Tool Download Behavior)

Alerts on execution of nimgrab.exe on Windows when hashes match known indicators.

FreeUnreviewedSigmahighv1

windows-process-creation-nimgrab-exe-execution-nim-tool-download-behavior-74a12f18

title: "Windows Process Creation: nimgrab.exe Execution (Nim Tool Download Behavior)"
id: 8bec29b8-542e-40fa-8a13-b3d838a3a1b8
status: test
description: This rule flags Windows process creation events where the executable name ends with \nimgrab.exe and the file matches specified hash indicators (MD5, SHA256, and IMPHASH). Attackers may use nimgrab to download additional payloads, aligning with command-and-control related staging behavior. The detection relies on process execution telemetry and file hash values to confirm the binary.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_nimgrab.yml
author: frack113, Huntrule Team
date: 2022-08-28
modified: 2024-11-23
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith: \nimgrab.exe
  selection_hashes:
    Hashes|contains:
      - MD5=2DD44C3C29D667F5C0EF5F9D7C7FFB8B
      - SHA256=F266609E91985F0FE3E31C5E8FAEEEC4FFA5E0322D8B6F15FE69F4C5165B9559
      - IMPHASH=C07FDDD21D123EA9B3A08EEF44AAAC45
  condition: 1 of selection_*
falsepositives:
  - Legitimate use of Nim on a developer systems
level: high
license: DRL-1.1
related:
  - id: 74a12f18-505c-4114-8d0b-8448dd5485c6
    type: derived

What it detects

This rule flags Windows process creation events where the executable name ends with \nimgrab.exe and the file matches specified hash indicators (MD5, SHA256, and IMPHASH). Attackers may use nimgrab to download additional payloads, aligning with command-and-control related staging behavior. The detection relies on process execution telemetry and file hash values to confirm the binary.

Known false positives

Legitimate use of Nim on a developer systems

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.