CrackMapExec File Indicators

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•20

Detects the creation of files with specific naming patterns and paths commonly used by the post-exploitation tool CrackMapExec. This includes PowerShell scripts like 'temp.ps1' and 'msol.ps1' in the 'C:\Windows\Temp\' directory, as well as temporary files with UUID-like or 8-character alphanumeric names.