Windows Process Creation: Hydra Password Bruteforce Command-Line Parameters

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1110Brute Force
- T1110.001Password Guessing
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process executions whose command line includes Hydra-style password guessing parameters. Attackers rely on tools like Hydra to automate credential brute forcing by supplying target usernames and passwords via command-line options. The detection depends on process creation telemetry and string matching within the spawned process CommandLine fields for the expected option patterns and caret-wrapped placeholders.

Reporting behind it

Related detections9 linkedT1110 — drag to rearrange

Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)

Malicious Brutforce on Windows OpenSSH Server with Valid Users (via security)

Malicious RDP Discovery Performed on Multiple Hosts (via rdp)

Suspicious Bruteforce via Password Reset (via security)

Possible SonicWall Credential Testing via userLogin Endpoint

Malicious Brutforce Enumeration with Unexisting Users - Kerberos (via security)

Suspicious JumpCloud Password Brute Force Followed by Success

Windows Process Creation: Hydra Password Bruteforce Command-Line Parameters

Pivot detection · T1110 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-command-line-indicates-thc-hydra-password-bruteforce-pa-aaafa146

title: "Windows Process Creation: Hydra Password Bruteforce Command-Line Parameters"
id: 1bf5ac5b-611b-486a-b276-55a8197bf2f1
status: test
description: This rule flags Windows process executions whose command line includes Hydra-style password guessing parameters. Attackers rely on tools like Hydra to automate credential brute forcing by supplying target usernames and passwords via command-line options. The detection depends on process creation telemetry and string matching within the spawned process CommandLine fields for the expected option patterns and caret-wrapped placeholders.
references:
  - https://github.com/vanhauser-thc/thc-hydra
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_hydra.yml
author: Vasiliy Burov, Huntrule Team
date: 2020-10-05
modified: 2023-02-04
tags:
  - attack.credential-access
  - attack.t1110
  - attack.t1110.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - "-u "
      - "-p "
    CommandLine|contains:
      - ^USER^
      - ^PASS^
  condition: selection
falsepositives:
  - Software that uses the caret encased keywords PASS and USER in its command line
level: high
license: DRL-1.1
related:
  - id: aaafa146-074c-11eb-adc1-0242ac120002
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL