HackTool - Hashcat Password Cracker Execution

About the rule

Rule Type

Standard

Rule Description

Detects execution of the Hashcat password cracking tool targeting Windows SAM file hashes with typical command-line flags indicating brute-force password cracking attempts.

Severity

Trouble

Rule journey

Attack chain scenario

Credential Access (T1110.002) → Unauthorized Access → Lateral Movement

Impact

Recovery of user credentials through password cracking, enabling unauthorized access and lateral movement within the network.

Rule Requirement

Prerequisites

Using Windows Event Viewer

1. Log in to a domain controller with domain admin credentials.
2. Open the Group Policy Management Console by typing gpmc.msc in the Run dialog.
3. Create a new GPO or edit an existing one linked to the appropriate OU.
4. Navigate to:
   Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Detailed Tracking
   • Right-click on Audit Process Creation, select Properties, choose Configure the following audit events, check Success, and click OK.
   • Right-click on Audit Process Termination, select Properties, choose Configure the following audit events, check Success, and click OK.
5. For command line tracking:
   Go to Computer Configuration → Administrative Templates → System → Audit Process Creation
   • Double-click Include command line in process creation events, select Enabled, and click OK.
6. Open the Registry Editor and create a new registry key at:
   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Security-Auditing\Operational

Using Sysmon

1. Download and install Sysmon from Microsoft Sysinternals.
2. Open Command Prompt as Administrator.
3. Use a Sysmon configuration file that includes process creation monitoring.
4. Install Sysmon with the configuration using the command:
   sysmon.exe -i config.xml
5. Your configuration file should include a section to monitor process creation like this:
   Sysmon → EventFiltering → ProcessCreate (onmatch="exclude")
   (This will log all process creations.)
6. Open the Registry Editor and ensure the following key exists:
   Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Sysmon\Operational

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

T1110.002 – Brute Force: Password Cracking

Security Standards

Implementation of multi-factor authentication and strong, NIST-compliant password policies to mitigate risk of brute force attacks.

Author

frack113

Future actions

Known False Positives

Other tools using similar command-line parameters may trigger detections erroneously.

Next Steps

• Investigate detected executions of Hashcat for unauthorized activity.
• Enforce multi-factor authentication across user and admin accounts.
• Review and strengthen password policies per NIST guidelines.
• Enhance process auditing for ongoing monitoring of credential cracking tools.
• Educate users on credential safety and password hygiene.

Mitigation