Detect password hash cracking tool execution on a host

Siemphony@siemphonyhighT1110.002unverifiedPlaybook · Credential theft

Matches process creation of known password-hash cracking binaries, which is MITRE's HashToolName knob from AN0292 written out as an Image list. Cracking is overwhelmingly an offline activity performed on adversary-controlled hardware, so this rule does not observe the cracking — it observes the tooling appearing on a managed host, which is the only part of the behaviour that reaches endpoint telemetry at all. AN0292's other signals are a correlation: the preceding SAM/SYSTEM/NTDS.dit access named by FilePathIndicators, then sustained CPU or GPU load while the tool runs. Sigma can express neither a join nor a resource-usage threshold, so nothing here pretends to; the rule matches on Image alone, which every backend renders, at the cost of missing a renamed binary. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0105, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Detect password hash cracking tool execution on a host2id: eeafbb5b-e54d-49d5-ac6e-c321f675cd823status: experimental4description: |5  Matches process creation of known password-hash cracking binaries, which is6  MITRE's HashToolName knob from AN0292 written out as an Image list. Cracking7  is overwhelmingly an offline activity performed on adversary-controlled8  hardware, so this rule does not observe the cracking — it observes the tooling9  appearing on a managed host, which is the only part of the behaviour that10  reaches endpoint telemetry at all. AN0292's other signals are a correlation:11  the preceding SAM/SYSTEM/NTDS.dit access named by FilePathIndicators, then12  sustained CPU or GPU load while the tool runs. Sigma can express neither a13  join nor a resource-usage threshold, so nothing here pretends to; the rule14  matches on Image alone, which every backend renders, at the cost of missing a15  renamed binary.16  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0105, not hand-written and not tested by its author. Any lab result is on this rule's own page.17references:18  - https://attack.mitre.org/techniques/T1110/00219  - https://attack.mitre.org/detectionstrategies/DET010520author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)21date: 2026-08-1622tags:23  - attack.credential-access24  - attack.t1110.00225logsource:26  category: process_creation27  product: windows28detection:29  selection:30    Image|endswith:31      - '\hashcat.exe'32      - '\hashcat32.exe'33      - '\hashcat64.exe'34      - '\hashcat-legacy.exe'35      - '\john.exe'36      - '\john-omp.exe'37      - '\john-mmx.exe'38      - '\ophcrack.exe'39      - '\rcrack.exe'40      - '\rcracki_mt.exe'41      - '\l0phtcrack.exe'42  condition: selection43falsepositives:44  - "Authorised password-audit and red-team engagements. A security team cracking a sanctioned NTDS.dit extract produces a byte-identical process creation event; MITRE's ExecutionContext knob is the discriminator, so scope the rule by account and by the hosts designated for audit work rather than by tool name."45  - "Analyst and researcher workstations where these binaries are installed from a package manager (Chocolatey, Scoop, winget) and launched with `--help`, `--benchmark` or against a self-made test hash while someone learns the tool."46  - "Filename collisions. The match is Image-only, per MITRE's HashToolName knob being a name list rather than a hash list, so any unrelated binary named john.exe or rcrack.exe — a build artefact, a personal utility — alerts. Pair with the KnownGood publisher or hash of your permitted copies."47level: high

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\hashcat.exe" or FolderPath endswith "\\hashcat32.exe" or FolderPath endswith "\\hashcat64.exe" or FolderPath endswith "\\hashcat-legacy.exe" or FolderPath endswith "\\john.exe" or FolderPath endswith "\\john-omp.exe" or FolderPath endswith "\\john-mmx.exe" or FolderPath endswith "\\ophcrack.exe" or FolderPath endswith "\\rcrack.exe" or FolderPath endswith "\\rcracki_mt.exe" or FolderPath endswith "\\l0phtcrack.exe")

Splunk · SPL

Run this as a search.

index=* (Image="*\\hashcat.exe" OR Image="*\\hashcat32.exe" OR Image="*\\hashcat64.exe" OR Image="*\\hashcat-legacy.exe" OR Image="*\\john.exe" OR Image="*\\john-omp.exe" OR Image="*\\john-mmx.exe" OR Image="*\\ophcrack.exe" OR Image="*\\rcrack.exe" OR Image="*\\rcracki_mt.exe" OR Image="*\\l0phtcrack.exe")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\hashcat.exe" OR TO_LOWER(process.executable) LIKE "*\\\\hashcat32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\hashcat64.exe" OR TO_LOWER(process.executable) LIKE "*\\\\hashcat-legacy.exe" OR TO_LOWER(process.executable) LIKE "*\\\\john.exe" OR TO_LOWER(process.executable) LIKE "*\\\\john-omp.exe" OR TO_LOWER(process.executable) LIKE "*\\\\john-mmx.exe" OR TO_LOWER(process.executable) LIKE "*\\\\ophcrack.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rcrack.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rcracki_mt.exe" OR TO_LOWER(process.executable) LIKE "*\\\\l0phtcrack.exe")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\hashcat\.exe$|\\hashcat32\.exe$|\\hashcat64\.exe$|\\hashcat-legacy\.exe$|\\john\.exe$|\\john-omp\.exe$|\\john-mmx\.exe$|\\ophcrack\.exe$|\\rcrack\.exe$|\\rcracki_mt\.exe$|\\l0phtcrack\.exe$)</field>    <description>Detect password hash cracking tool execution on a host</description>    <mitre>      <id>T1110.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: brute_force
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: eeafbb5b-e54d-49d5-ac6e-c321f675cd82

ATT&CKT1110.002

T1110.002Password Cracking

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1110.002, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add `OriginalFileName`. One line, and it closes the rename bypass.
Split by intent. Keep the name list at low as a tool-presence signal and
Apply MITRE's ExecutionContext knob by account and by host: scope out the
Add Cain.exe and johnny.exe — both Windows-native, both what an

Declared by the author

Authorised password-audit and red-team engagements. A security team cracking a sanctioned NTDS.dit extract produces a byte-identical process creation event; MITRE's ExecutionContext knob is the discriminator, so scope the rule by account and by the hosts designated for audit work rather than by tool name.
Analyst and researcher workstations where these binaries are installed from a package manager (Chocolatey, Scoop, winget) and launched with --help, --benchmark or against a self-made test hash while someone learns the tool.
Filename collisions. The match is Image-only, per MITRE's HashToolName knob being a name list rather than a hash list, so any unrelated binary named john.exe or rcrack.exe — a build artefact, a personal utility — alerts. Pair with the KnownGood publisher or hash of your permitted copies.

Lessonbrute force

brute forceAI draft — unreviewed

01 · What this rule detects

The appearance of a password-hash cracking binary on a managed Windows host — hashcat.exe, john.exe, ophcrack.exe and eight siblings — as a process creation event. Read the title against the technique name: this is not a detection of password cracking. Cracking is overwhelmingly done offline, on adversary-controlled GPUs, using hashes carried out of the estate; MITRE's own technique text says so. What reaches endpoint telemetry is the tooling. The rule's description is unusually candid about that, and the honesty is the first teaching point. A rule whose title promises the behaviour and whose logic delivers a tool inventory will be misread in a triage queue. This one names the gap up front.

02 · Telemetry you need

category: process_creation, product: windows, copied verbatim from
On Security 4688 rather than Sysmon EventID 1, Audit Process Creation must
A large blind spot: WSL2. hashcat and john run inside WSL2 produce no

03 · How the logic works

One selection, one field:

That is the whole rule. The rendered SPL is an eleven-way OR over Image and the Wazuh output a single anchored pcre2 alternation. Nothing else is tested. Why a name list and nothing more? AN0292's other signals are a correlation — prior SAM/SYSTEM/NTDS.dit access (MITRE's FilePathIndicators) followed by sustained CPU or GPU load while the tool runs. Sigma expresses neither a join nor a resource-usage threshold, so the author declined to fake either. Correct instinct. The defect worth learning from: matching Image only means ren hashcat.exe upd.exe is the entire bypass, and the fix was one line away and inside the project's own approved field list. OriginalFileName is a real Sysmon EventID 1 field — it reads the name baked into the PE version resource at compile time, which a rename on disk does not touch, and both the hashcat and John the Ripper Windows builds carry it. ORing OriginalFileName|endswith with the same list into the selection survives a rename and degrades gracefully: the field is simply absent on Security 4688, so those hosts fall back to today's behaviour. The description concedes the gap ("at the cost of missing a renamed binary") and the third false positive leans on it as rationale — but conceding a defect does not convert it into a design choice when the remedy is one field away and the practitioners of this technique rename tooling by reflex. Attribution: MITRE's HashToolName knob says "match execution against known cracking toolnames like hashcat.exe, john.exe, etc." — two examples and an "etc." The eleven-entry list is the author's expansion of that knob, not MITRE's inventory. FilePathIndicators and ExecutionContext are MITRE's other two knob names; neither is implemented here.

04 · Common false positives

Authorised password auditing, on a schedule, forever. The rule's first
Analyst workstations where these binaries arrive via Chocolatey, Scoop or
Filename collisions: john.exe and rcrack.exe are ordinary names.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0105 and never executed against a log line. The rule is contract-clean — verbatim logsource, real fields, correct sigmaTactics tag, terminal UNVERIFIED line — and that is orthogonal to whether it works.
tier_2: begins by running it for a fortnight and seeing what the standing volume is: almost certainly your own audit tooling and your own security staff.
tier_3: means AN0292's real chain — SAM/SYSTEM/NTDS.dit access from Security 4663, then this execution, then sustained GPU load — which needs a correlation engine, not a Sigma rule.

Related detections1 nearby

Execution of a port or network service scanning utility

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/eeafbb5b-e54d-49d5-ac6e-c321f675cd82

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect password hash cracking tool execution on a host

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it