Remote Thread Created In KeePass.EXE

Title: Remote Thread Created In KeePass.EXE
Status: test
Description:Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
References:
  -https://www.cisa.gov/uscert/ncas/alerts/aa20-259a
  -https://github.com/denandz/KeeFarce
  -https://github.com/GhostPack/KeeThief
Author: Timon Hackenjos
Date: 2022-04-22
modified:2023-05-05
Tags:

• -'attack.credential-access'
• -'attack.t1555.005'

Logsource:

• product: windows
• category: create_remote_thread

Detection:
  selection:
    TargetImage|endswith: '\KeePass.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: high