Windows Process Creation: SafetyKatz HackTool Execution

title: "Windows Process Creation: SafetyKatz HackTool Execution"
id: 041146da-2936-4532-95fa-7e34a3deb190
status: test
description: This rule matches Windows process creation events where the executed image ends with \SafetyKatz.exe, or where the process metadata fields identify OriginalFileName as SafetyKatz.exe and Description as SafetyKatz. SafetyKatz is commonly used to target credential material, so spotting its execution helps detect credential-access tooling being run. The detection relies on process creation telemetry and process metadata fields such as image path, OriginalFileName, and Description.
references:
  - https://github.com/GhostPack/SafetyKatz
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_safetykatz.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-20
modified: 2023-02-04
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \SafetyKatz.exe
    - OriginalFileName: SafetyKatz.exe
    - Description: SafetyKatz
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: b1876533-4ed5-4a83-90f3-b8645840a413
    type: derived