HackTool - SecurityXploded Execution

Title: HackTool - SecurityXploded Execution
Status: stable
Description:Detects the execution of SecurityXploded Tools
References:
  -https://securityxploded.com/
  -https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/
Author: Florian Roth (Nextron Systems)
Date: 2018-12-19
modified:2023-02-04
Tags:

• -'attack.credential-access'
• -'attack.t1555'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Company:'SecurityXploded' Image|endswith:'PasswordDump.exe' OriginalFileName|endswith:'PasswordDump.exe'   condition:selection
Falsepositives:
  -Unlikely
Level: critical