Windows: Hashcat.exe Password Cracking Execution via Registry-Sourced SAM

Alerts on Hashcat.exe launched with cracking-focused flags targeting an offline SAM-derived dataset.

FreeUnreviewedSigmahighv1

windows-hashcat-exe-password-cracking-execution-via-registry-sourced-sam-39b31e81

title: "Windows: Hashcat.exe Password Cracking Execution via Registry-Sourced SAM"
id: 1b783eba-2504-4627-a1e2-f29df6aeacc7
status: test
description: This rule flags process creation events where Hashcat.exe is executed with command-line arguments consistent with password cracking against a captured SAM source. Attackers commonly use credential-cracking tools like Hashcat to recover plaintext credentials, enabling further access. The detection relies on Windows process creation telemetry that includes the executable path and the command-line parameters.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.002/T1110.002.md#atomic-test-1---password-cracking-with-hashcat
  - https://hashcat.net/wiki/doku.php?id=hashcat
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_hashcat.yml
author: frack113, Huntrule Team
date: 2021-12-27
modified: 2023-02-04
tags:
  - attack.credential-access
  - attack.t1110.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \hashcat.exe
  selection_cli:
    CommandLine|contains|all:
      - "-a "
      - "-m 1000 "
      - "-r "
  condition: 1 of selection_*
falsepositives:
  - Tools that use similar command line flags and values
level: high
license: DRL-1.1
related:
  - id: 39b31e81-5f5f-4898-9c0e-2160cfc0f9bf
    type: derived

What it detects

This rule flags process creation events where Hashcat.exe is executed with command-line arguments consistent with password cracking against a captured SAM source. Attackers commonly use credential-cracking tools like Hashcat to recover plaintext credentials, enabling further access. The detection relies on Windows process creation telemetry that includes the executable path and the command-line parameters.

Known false positives

Tools that use similar command line flags and values

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.