cscli scenarios install sigmahq/proc_creation_win_hktl_localpotato1type: trigger2name: sigmahq/proc_creation_win_hktl_localpotato3description: |4 Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Image endsWith '\\LocalPotato.exe' || evt.Parsed.CommandLine contains '.exe -i C:\\' && evt.Parsed.CommandLine contains '-o Windows\\' || evt.Parsed.Hashes contains 'IMPHASH=E1742EE971D6549E8D4D81115F88F1FC' || evt.Parsed.Hashes contains 'IMPHASH=DD82066EFBA94D7556EF582F247C8BB5' || evt.Parsed.Imphash in ['E1742EE971D6549E8D4D81115F88F1FC', 'DD82066EFBA94D7556EF582F247C8BB5'])7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:1415 label: "HackTool - LocalPotato Execution"16 behavior : "windows:audit"17 remediation: false1819scope:20 type: ParentProcessId21 expression: evt.Parsed.ParentProcessId2223