title: Detection of SafetyKatz
id: e074832a-eada-4fd7-94a1-10642b130e16
status: test
description: Detects possible SafetyKatz Behaviour
author: Markus Neis
references:
  - https://github.com/GhostPack/SafetyKatz
date: 2018/07/24
modified: 2021/11/27
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '\Temp\debug.bin'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.credential_access
  - attack.t1003.001
