Hacktool Execution via PE Metadata - Cube0x0 Tools
Detects the execution of hacktools developed by 'Cube0x0' by identifying the 'Company' field in the executable's PE metadata. This allows detection even if the tool's filename has been changed. Examples of tools by this author include SharpPrintNightmare, KrbRelay, and SharpMapExec, which are often used for credential access and resource development.
Sigma
