Sigma rules for CVE-2022-0725
1 rules · scoped to cve · back to CVE-2022-0725
Direct rules mention this entity in their title or description. Related rules cover the techniques this entity is known to use.
title: Remote Thread Created In KeePass.EXE
id: 77564cc2-7382-438b-a7f6-395c2ae53b9a
status: test
description: Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
references:
- https://www.cisa.gov/uscert/ncas/alerts/aa20-259a
- https://github.com/denandz/KeeFarce
- https://github.com/GhostPack/KeeThief
author: Timon Hackenjos
date: 2022-04-22
modified: 2023-05-05
tags:
- attack.credential-access
- attack.t1555.005
logsource:
product: windows
category: create_remote_thread
detection:
selection:
TargetImage|endswith: '\KeePass.exe'
condition: selection
falsepositives:
- Unknown
level: high