title: Windows Hacktool Imphash
id: 24e3e58a-646b-4b50-adef-02ef935b9fc8
description: Detects the use of Windows hacktools based on their import hash (imphash) even if the files have been renamed
status: experimental
author: Florian Roth
references:
    - Internal Research
date: 2022/03/04
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Imphash: 
            - bcca3c247b619dcd13c8cdff5f123932 # PetitPotam
            - 3a19059bd7688cb88e70005f18efc439 # PetitPotam
            - 9da6d5d77be11712527dcab86df449a3 # Mimikatz
            - a6e01bc1ab89f8d91d9eab72032aae88 # Mimikatz
            - d21bbc50dcc169d7b4d0f01962793154 # Mimikatz
            - 9528a0e91e28fbb88ad433feabca2456 # Mimikatz
            - 4c1b52a19748428e51b14c278d0f58e3 # Mimikatz
            - 725bb81dc24214f6ecacc0cfb36ad30d # Mimikatz
            - 672b13f4a0b6f27d29065123fe882dfc # Mimikatz
            - 0c106686a31bfe2ba931ae1cf6e9dbc6 # Mimikatz
            - 23867a89c2b8fc733be6cf5ef902f2d1 # JuicyPotato 
            - 9fb060c2977a9d9b782440b98d410c3e # RoguePotato
            - b18a1401ff8f444056d29450fbc0a6ce # Pwdump
            - 13f08707f759af6003837a150a371ba1 # Pwdump
            - 749a7bb1f0b4c4455949c0b2bf7f9e9f # Pwdump
            - 94cb940a1a6b65bed4d5a8f849ce9793 # PwDumpX
            - 1781f06048a7e58b323f0b9259be798b # Pwdump
            - cb567f9498452721d77a451374955f5f # Pwdump
            - 730073214094cd328547bf1f72289752 # Htran
            - 6eefd92bffbfb27f378b81c09ca96786 # Ncat
            - ac615fb1d93576fa3c26077a619c9144 # Ncat
        - Hashes|contains:  # Sysmon field hashes contains all types
            - bcca3c247b619dcd13c8cdff5f123932 # PetitPotam
            - 3a19059bd7688cb88e70005f18efc439 # PetitPotam
            - 9da6d5d77be11712527dcab86df449a3 # Mimikatz
            - a6e01bc1ab89f8d91d9eab72032aae88 # Mimikatz
            - d21bbc50dcc169d7b4d0f01962793154 # Mimikatz
            - 9528a0e91e28fbb88ad433feabca2456 # Mimikatz
            - 4c1b52a19748428e51b14c278d0f58e3 # Mimikatz
            - 725bb81dc24214f6ecacc0cfb36ad30d # Mimikatz
            - 672b13f4a0b6f27d29065123fe882dfc # Mimikatz
            - 0c106686a31bfe2ba931ae1cf6e9dbc6 # Mimikatz
            - 23867a89c2b8fc733be6cf5ef902f2d1 # JuicyPotato 
            - 9fb060c2977a9d9b782440b98d410c3e # RoguePotato
            - b18a1401ff8f444056d29450fbc0a6ce # Pwdump
            - 13f08707f759af6003837a150a371ba1 # Pwdump
            - 749a7bb1f0b4c4455949c0b2bf7f9e9f # Pwdump
            - 94cb940a1a6b65bed4d5a8f849ce9793 # PwDumpX
            - 1781f06048a7e58b323f0b9259be798b # Pwdump
            - cb567f9498452721d77a451374955f5f # Pwdump
            - 730073214094cd328547bf1f72289752 # Htran
            - 6eefd92bffbfb27f378b81c09ca96786 # Ncat
            - ac615fb1d93576fa3c26077a619c9144 # Ncat
    condition: selection
falsepositives:
    - Legitimate use of one of these tools
level: high