Sagan medium stable other

[WINDOWS-SYSMON] Installation of PyPyKatz Detected - Credential Harvesting Tool

[WINDOWS-SYSMON] Installation of PyPyKatz Detected - Credential Harvesting Tool

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg: "[WINDOWS-SYSMON] Installation of PyPyKatz Detected - Credential Harvesting Tool"; program: *Sysmon*; content: "1: Process Create"; content: "pip3 install pypykatz"; nocase; classtype: suspicious-traffic; reference: url, https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/; sid:5014600; rev:1; metadata:created_on 2024_04_18, severity critical;)

Field Validations

Loading…

Comments (0)

Loading comments...