HackTool - Hydra Password Bruteforce Execution
This rule detects the execution of the password guessing hack tool Hydra based on specific command-line parameters. It looks for the presence of '-u ' and '-p ' which are commonly used to specify username and password lists, respectively. Additionally, it checks for the keywords '^USER^' and '^PASS^' which are often used as placeholders in Hydra's command-line arguments for iterating through user and password lists during a brute-force attack.
Sigma
