Hacktool Execution - Imphash (24e3e58a-646b-4b50-adef-02ef935b9fc8)

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Tool - T1588.002 (a2fdce72-04b2-409a-ac10-cc1695f4fce0)	Attack Pattern	Hacktool Execution - Imphash (24e3e58a-646b-4b50-adef-02ef935b9fc8)	Sigma-Rules	1
Hacktool Execution - Imphash (24e3e58a-646b-4b50-adef-02ef935b9fc8)	Sigma-Rules	OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22)	Attack Pattern	1
Obtain Capabilities - T1588 (ce0687a0-e692-4b77-964a-0784a8e54ff1)	Attack Pattern	Tool - T1588.002 (a2fdce72-04b2-409a-ac10-cc1695f4fce0)	Attack Pattern	2