title: Hacktool by Cube0x0
id: 37c1333a-a0db-48be-b64b-7393b2386e3b
status: experimental
description: Detects the use of tools created by a well-known hacktool producer named Cube0x0, which includes his handle in all binaries as company information in the PE headers (SharpPrintNightmare, KrbRelay, SharpMapExec etc.)
author: Florian Roth
references:
  - https://github.com/cube0x0
  - https://www.virustotal.com/gui/search/metadata%253ACube0x0/files
date: 2022/04/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Company: 'Cube0x0'
  condition: selection
falsepositives:
  - Unlikely
level: high
