Nimgrab Execution Detected
This rule detects the execution of 'nimgrab.exe', a tool associated with the Nim programming framework, which is often used for downloading files. Detection is based on the process name 'nimgrab.exe' or specific file hashes (MD5, SHA256, Imphash) associated with known nimgrab binaries. This tool can be abused by adversaries for ingress tool transfer.
YARA-L
