Windows Process Execution of Hashcat.exe for Password Cracking
Alerts on Hashcat.exe launched with cracking-focused flags targeting an offline SAM-derived dataset.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-27
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of Hashcat.exe on Windows when the command line includes key cracking parameters: attack mode (-a), a specific hash mode (-m 1000), and a rules file argument (-r). Adversaries may use Hashcat to brute-force or otherwise recover credentials from offline password data, making this behavior a strong credential-access signal. Detection relies on process creation telemetry that includes the executable image path and full command line arguments.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.002/T1110.002.md#atomic-test-1---password-cracking-with-hashcat
- hashcat.nethttps://hashcat.net/wiki/doku.php?id=hashcat
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_hashcat.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Execution of Hashcat.exe for Password Cracking
id: 1b783eba-2504-4627-a1e2-f29df6aeacc7
status: test
description: "This rule identifies execution of Hashcat.exe on Windows when the command line includes key cracking parameters: attack mode (-a), a specific hash mode (-m 1000), and a rules file argument (-r). Adversaries may use Hashcat to brute-force or otherwise recover credentials from offline password data, making this behavior a strong credential-access signal. Detection relies on process creation telemetry that includes the executable image path and full command line arguments."
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.002/T1110.002.md#atomic-test-1---password-cracking-with-hashcat
- https://hashcat.net/wiki/doku.php?id=hashcat
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_hashcat.yml
author: frack113, Huntrule Team
date: 2021-12-27
modified: 2023-02-04
tags:
- attack.credential-access
- attack.t1110.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \hashcat.exe
selection_cli:
CommandLine|contains|all:
- "-a "
- "-m 1000 "
- "-r "
condition: 1 of selection_*
falsepositives:
- Tools that use similar command line flags and values
level: high
license: DRL-1.1
related:
- id: 39b31e81-5f5f-4898-9c0e-2160cfc0f9bf
type: derived