Detectionhightest

HackTool - CrackMapExec Execution

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Fri Feb 25Updated Wed Mar 0842a993dd-bb3e-48c8-b372-4d6684c4106cwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_binary:
        Image|endswith: '\crackmapexec.exe'
    selection_special:
        CommandLine|contains: ' -M pe_inject '
    selection_execute:
        CommandLine|contains|all:
            - ' --local-auth'
            - ' -u '
            - ' -x '
    selection_hash:
        CommandLine|contains|all:
            - ' --local-auth'
            - ' -u '
            - ' -p '
            - " -H 'NTHASH'"
    selection_module_mssql:
        CommandLine|contains|all:
            - ' mssql '
            - ' -u '
            - ' -p '
            - ' -M '
            - ' -d '
    selection_module_smb1:
        CommandLine|contains|all:
            - ' smb '
            - ' -u '
            - ' -H '
            - ' -M '
            - ' -o '
    selection_module_smb2:
        CommandLine|contains|all:
            - ' smb '
            - ' -u '
            - ' -p '
            - ' --local-auth'
    part_localauth_1:
        CommandLine|contains|all:
            - ' --local-auth'
            - ' -u '
            - ' -p '
    part_localauth_2:
        CommandLine|contains|all:
            - ' 10.'
            - ' 192.168.'
            - '/24 '
    condition: 1 of selection_* or all of part_localauth*

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0002 · Execution TA0003 · Persistence TA0004 · Privilege Escalation TA0006 · Credential Access TA0007 · Discovery

Techniques

T1047 · Windows Management Instrumentation T1053 · Scheduled Task/Job T1110 · Brute Force T1201 · Password Policy Discovery

Sub-techniques

T1059.003 · Windows Command Shell T1059.001 · PowerShell

Rule Metadata

Rule ID

42a993dd-bb3e-48c8-b372-4d6684c4106c

Status

test

Level

high

Type

Detection

Created

Fri Feb 25

Modified

Wed Mar 08

Author

Florian Roth (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml

Raw Tags

attack.executionattack.persistenceattack.privilege-escalationattack.credential-accessattack.discoveryattack.t1047attack.t1053attack.t1059.003attack.t1059.001attack.t1110attack.t1201

View on GitHub