[WINDOWS-SYSMON] KeePass Password Dumping

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] KeePass Password Dumping"; program:*Sysmon*; event_id:8; content:"
| 5c
| KeePass.exe"; nocase; reference:url,github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_password_dumper_keepass.yml; classtype:trojan-activity; sid:5013873; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_03_09, updated_at 2023_03_09, mitre_tactic_id TA0006, mitre_technique_id T1555.005;)