CrackMapExec Execution Patterns

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•17

Detects various execution patterns associated with the CrackMapExec (CME) pentesting framework. This includes specific command-line arguments used by CME for remote command execution via `cmd.exe` (targeting WMI or scheduled tasks for output redirection) and PowerShell execution with common obfuscation or encoding techniques.