Windows: Process creation command line indicates THC Hydra password bruteforce parameters

Alerts when Windows process command lines include Hydra -u/-p parameters with USER/PASS placeholders.

FreeUnreviewedSigmahighv1

windows-process-creation-command-line-indicates-thc-hydra-password-bruteforce-pa-aaafa146

title: "Windows: Process creation command line indicates THC Hydra password bruteforce parameters"
id: 1bf5ac5b-611b-486a-b276-55a8197bf2f1
status: test
description: This rule flags process executions whose command line includes Hydra-style credentials parameters for username (-u) and password (-p), including caret-encased placeholders for USER and PASS. Attackers commonly use password bruteforce tools to guess credentials, so matching these interactive command-line patterns can help identify active credential access attempts. The detection relies on process creation telemetry with full command-line content on Windows.
references:
  - https://github.com/vanhauser-thc/thc-hydra
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_hydra.yml
author: Vasiliy Burov, Huntrule Team
date: 2020-10-05
modified: 2023-02-04
tags:
  - attack.credential-access
  - attack.t1110
  - attack.t1110.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - "-u "
      - "-p "
    CommandLine|contains:
      - ^USER^
      - ^PASS^
  condition: selection
falsepositives:
  - Software that uses the caret encased keywords PASS and USER in its command line
level: high
license: DRL-1.1
related:
  - id: aaafa146-074c-11eb-adc1-0242ac120002
    type: derived

What it detects

This rule flags process executions whose command line includes Hydra-style credentials parameters for username (-u) and password (-p), including caret-encased placeholders for USER and PASS. Attackers commonly use password bruteforce tools to guess credentials, so matching these interactive command-line patterns can help identify active credential access attempts. The detection relies on process creation telemetry with full command-line content on Windows.

Known false positives

Software that uses the caret encased keywords PASS and USER in its command line

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.