Windows process creation: CrackMapExec execution via characteristic command-line flags
Alerts on Windows process creation showing CrackMapExec-style command-line flags for local auth and module execution.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-02-25
- Updated
- 2026-07-31
ATT&CK techniques
Execution → DiscoveryRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the executable name ends with "\crackmapexec.exe" and the command line contains characteristic flag combinations, including module usage and local-auth options. The behavior matters because CrackMapExec is often used for credential checking and remote management activities, and attackers may replace the binary while keeping the same operational flags. Detection relies on process creation telemetry with command-line arguments and the process image path.
Reporting behind it
- mpgn.gitbook.iohttps://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local
- mandiant.comhttps://www.mandiant.com/resources/telegram-malware-iranian-espionage
- infosecmatter.comhttps://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz
- infosecmatter.comhttps://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows process creation: CrackMapExec execution via characteristic command-line flags"
id: bd0eca4e-dc2f-49b8-8387-d4eeaa39009b
status: test
description: This rule flags Windows process creation events where the executable name ends with "\crackmapexec.exe" and the command line contains characteristic flag combinations, including module usage and local-auth options. The behavior matters because CrackMapExec is often used for credential checking and remote management activities, and attackers may replace the binary while keeping the same operational flags. Detection relies on process creation telemetry with command-line arguments and the process image path.
references:
- https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local
- https://www.mandiant.com/resources/telegram-malware-iranian-espionage
- https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz
- https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-25
modified: 2023-03-08
tags:
- attack.execution
- attack.persistence
- attack.privilege-escalation
- attack.credential-access
- attack.discovery
- attack.t1047
- attack.t1053
- attack.t1059.003
- attack.t1059.001
- attack.t1110
- attack.t1201
logsource:
category: process_creation
product: windows
detection:
selection_binary:
Image|endswith: \crackmapexec.exe
selection_special:
CommandLine|contains: " -M pe_inject "
selection_execute:
CommandLine|contains|all:
- " --local-auth"
- " -u "
- " -x "
selection_hash:
CommandLine|contains|all:
- " --local-auth"
- " -u "
- " -p "
- " -H 'NTHASH'"
selection_module_mssql:
CommandLine|contains|all:
- " mssql "
- " -u "
- " -p "
- " -M "
- " -d "
selection_module_smb1:
CommandLine|contains|all:
- " smb "
- " -u "
- " -H "
- " -M "
- " -o "
selection_module_smb2:
CommandLine|contains|all:
- " smb "
- " -u "
- " -p "
- " --local-auth"
part_localauth_1:
CommandLine|contains|all:
- " --local-auth"
- " -u "
- " -p "
part_localauth_2:
CommandLine|contains|all:
- " 10."
- " 192.168."
- "/24 "
condition: 1 of selection_* or all of part_localauth*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 42a993dd-bb3e-48c8-b372-4d6684c4106c
type: derived