Hacktool Execution - PE Metadata

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•0•0

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed