cscli scenarios install sigmahq/proc_creation_win_hktl_pypykatz1type: trigger2name: sigmahq/proc_creation_win_hktl_pypykatz3description: |4 Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '\\pypykatz.exe' || evt.Parsed.Image endsWith '\\python.exe') && evt.Parsed.CommandLine contains 'live' && evt.Parsed.CommandLine contains 'registry')7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1003.0021516 label: "HackTool - Pypykatz Credentials Dumping Activity"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324