Hacktool Execution - Imphash — Detection Rule

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Read the full analysis on IntelFusions