Hashcat Password Cracker Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

This rule detects the execution of the Hashcat password cracking tool. It specifically looks for the `hashcat.exe` executable and command-line arguments indicative of cracking NTLM hashes (`-m 1000`) and using a rule file (`-r `). The rule aims to identify attempts to crack passwords, potentially using SAM file contents obtained from a Windows registry.