HackTool - Quarks PwDump Execution
Detects the execution of Quarks PwDump, a tool used for dumping credentials, by monitoring process creation events for its executable name and specific command-line arguments. The rule looks for 'QuarksPwDump.exe' and various flags associated with dumping local hashes, domain cached hashes, BitLocker keys, and domain hashes, including those from NTDS files.
Sigma
