huntrule

Windows File Creation of CrackMapExec-Related Temp Scripts and Output Files

Flags Windows file creation in C:\Windows\Temp\ with filenames and patterns associated with CrackMapExec artifacts.

FreeReviewedSigma · High · v2
Product
windows
Category
file_event
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2024-03-11
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows file creation events where the target filename is in C:\Windows\Temp\ and matches specific script or output naming patterns associated with CrackMapExec. Attackers may drop PowerShell payloads and generated marker/data files in this location to support credential access and execution workflows. Detection relies on Windows file event telemetry that captures TargetFilename for newly created files, including full paths and filenames.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange
Malicious PowerDump Credential Extraction via PowerShell
Malicious LSASS Credential Dump via rundll32 comsvcs.dll (via process_creation)
Malicious LSASS Memory Dump via rundll32 comsvcs MiniDump in tasklist For-Loop (via process_creation)
Malicious Mimikatz Credential Dumping via Command Line Arguments
Malicious Credential Extraction via Volatility Memory Analysis (via process_creation)
Suspicious Physical Memory Acquisition via WinPmem (via process_creation)
Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)
Suspicious LSASS Credential Access via PowerShell (via process_creation)
Suspicious LSASS Memory Dump via Task Manager After Ivanti Exploitation
Windows File Creation of CrackMapExec-Related Temp Scripts and Output Files
Pivot detection · T1003.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.