Password Cracking
Where this stands
One published detection covers this technique. Every one is unverified — no rule on Siemphony has been executed against real telemetry.
What the technique is
Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. OS Credential Dumping can be used to obtain password hashes, this may only get an adversary so far when Pass the Hash is not an option. Further, adversaries may leverage Data from Configuration Repository in order to obtain hashed credentials for network devices. Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network. The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0292
Use of hash-cracking tools (e.g., John the Ripper, Hashcat) after credential dumping, combined with high CPU usage or GPU invocation via unsigned binaries accessing password hash files
- AN0293
Execution of hash cracking binaries or scripts (e.g., john, hashcat) following access to shadow file or dumped hashes
- AN0294
Unsigned or scripting-based processes invoking password cracking binaries or accessing hashed credential artifacts post-login
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.