{
  "family": "hckpk",
  "sample_count": 4,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Hckpk is a generic detection classification used for various **HackTools and Password Crackers**. These are technically dual-use utilities; they can be used legitimately by penetration testers and red teams to audit security, but they are frequently deployed by malicious threat actors during the lateral movement phase of an attack to harvest credentials and escalate privileges.<br><br><b>Understanding HackTools (Hckpk)</b><br>To a standard user, these tools are never seen. For a SOC analyst, detecting a 'HackTool' alert on a standard employee workstation is a massive red flag. It almost certainly indicates that an attacker has already bypassed perimeter defenses, gained initial access, and is now actively attempting to compromise administrative accounts or move laterally across the network.<br><br><b>Execution and Credential Harvesting Mechanics</b><br>Threat actors deploy Hckpk tools (which may include custom scripts, Mimikatz variants, or hash dumpers) after establishing a foothold (`T1105`). These tools often require administrative or SYSTEM privileges to function effectively (`T1068`). Once executed (`T1204.002`), the tools perform actions such as dumping the SAM (Security Account Manager) database (`T1003.002`), extracting plaintext passwords or NTLM hashes from LSASS (Local Security Authority Subsystem Service) memory (`T1003.001`), or executing brute-force attacks against local network services (`T1110`). The stolen credentials are then used to forge Kerberos tickets (Pass-the-Ticket) or directly authenticate to other servers (Pass-the-Hash) (`T1550.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is rapid privilege escalation and lateral movement, potentially leading to total domain compromise. Host-based IoCs include EDR alerts for anomalous processes attempting to read the memory space of `lsass.exe`, unauthorized access to the `SAM` registry hive, or the execution of known hacking tools (even if renamed). Network IoCs include sudden bursts of SMB or RDP traffic originating from a compromised workstation to multiple servers, indicating lateral movement using harvested credentials.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1003.002",
    "T1068",
    "T1550.002",
    "T1003.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1003.001",
      "name": "OS Credential Dumping: LSASS Memory",
      "tactic": "Credential Access"
    },
    {
      "id": "T1003.002",
      "name": "OS Credential Dumping: Security Account Manager (SAM)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1550.002",
      "name": "Use Alternate Authentication Material: Pass the Hash",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "tactic": "Privilege Escalation"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint where the HackTool was detected, as it indicates an active, hands-on-keyboard attacker.",
    "Assume all credentials that were active in memory on that machine (including Domain Admin credentials if a tier 0 admin logged in) are compromised.",
    "Initiate enterprise-wide password resets for any accounts identified as compromised, and closely monitor Active Directory for the creation of anomalous new accounts.",
    "Hunt across the network for the specific tool hash or behavioral patterns, as attackers often deploy HackTools to multiple machines simultaneously."
  ],
  "what_to_avoid": [
    "Do not treat a HackTool detection as a low-priority 'PUA' alert; it is a strong indicator of an active, escalating breach.",
    "Avoid allowing high-privileged accounts (like Domain Admins) to log into standard user workstations, as this exposes their credentials to LSASS dumping tools."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}