Hacktool Execution - PE Metadata (37c1333a-a0db-48be-b64b-7393b2386e3b)

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Hacktool Execution - PE Metadata (37c1333a-a0db-48be-b64b-7393b2386e3b)	Sigma-Rules	Tool - T1588.002 (a2fdce72-04b2-409a-ac10-cc1695f4fce0)	Attack Pattern	1
Hacktool Execution - PE Metadata (37c1333a-a0db-48be-b64b-7393b2386e3b)	Sigma-Rules	OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22)	Attack Pattern	1
Obtain Capabilities - T1588 (ce0687a0-e692-4b77-964a-0784a8e54ff1)	Attack Pattern	Tool - T1588.002 (a2fdce72-04b2-409a-ac10-cc1695f4fce0)	Attack Pattern	2