Rule Info
Name
HKTL_Poolparty_Mar24
Author
Arnim Rupp
Description
Detects Poolparty, a hacktool for process injection techniques abusing Windows Thread Pools
Score
80
Date
2024-03-25
Minimum Yara
3.5.0
Rule Hash
b79a938803d71ce757bbf1cf080ba836
Tags
['FILE', 'EXE', 'HKTL']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
36
Suspicious (< 10 engines)
7
Clean (0 engines)
0
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR