Windows File Event Indicators for CrackMapExec HackTool Artifacts

title: Windows File Event Indicators for CrackMapExec HackTool Artifacts
id: f8bb5185-6bd7-4421-ae2f-f12c84a5f06b
related:
  - id: 9433ff9c-5d3f-4269-99f8-95fc826ea489
    type: obsolete
  - id: 736ffa74-5f6f-44ca-94ef-1c0df4f51d2a
    type: derived
status: test
description: This rule identifies Windows file creation activity where the target filename starts in C:\Windows\Temp\ and ends with specific PowerShell script names or matches known CrackMapExec-style output filename patterns. Attackers may drop transient scripts and tool-generated artifacts into this directory to support credential access workflows and remote execution. It relies on Windows file event telemetry containing the full target filename to match hardcoded path and filename patterns.
references:
  - https://github.com/byt3bl33d3r/CrackMapExec/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_crackmapexec_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-03-11
modified: 2024-06-27
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: file_event
detection:
  selection_path:
    TargetFilename|startswith: C:\Windows\Temp\
  selection_names_str:
    TargetFilename|endswith:
      - \temp.ps1
      - \msol.ps1
  selection_names_re:
    - TargetFilename|re: \\[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.txt$
    - TargetFilename|re: \\[a-zA-Z]{8}\.tmp$
  condition: selection_path and 1 of selection_names_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1