HackTool - Generic Process Access
Detects process access requests from known hacktool processes based on their executable names. This rule targets a wide range of tools commonly used for credential dumping, privilege escalation, and other malicious activities, including Mimikatz, various Potato exploits, and other offensive security tools. The detection focuses on the 'SourceImage' field, indicating the process initiating the access.
Sigma
