cscli scenarios install sigmahq/proc_creation_win_pua_nimgrab1type: trigger2name: sigmahq/proc_creation_win_pua_nimgrab3description: |4 Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Image endsWith '\\nimgrab.exe' || evt.Parsed.Hashes contains 'MD5=2DD44C3C29D667F5C0EF5F9D7C7FFB8B' || evt.Parsed.Hashes contains 'SHA256=F266609E91985F0FE3E31C5E8FAEEEC4FFA5E0322D8B6F15FE69F4C5165B9559' || evt.Parsed.Hashes contains 'IMPHASH=C07FDDD21D123EA9B3A08EEF44AAAC45' || evt.Parsed.md5 == '2DD44C3C29D667F5C0EF5F9D7C7FFB8B' || evt.Parsed.sha256 == 'F266609E91985F0FE3E31C5E8FAEEEC4FFA5E0322D8B6F15FE69F4C5165B9559' || evt.Parsed.Imphash == 'C07FDDD21D123EA9B3A08EEF44AAAC45')7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t11051516 label: "PUA - Nimgrab Execution"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324