Hacktool Execution - Imphash

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•0•0

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed