Hashcat or John Password Cracking Tool Network Activity

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects network activity associated with password cracking tools like Hashcat or John the Ripper. It specifically looks for HTTP user agent strings containing "hashcat" or "john.the.ripper" in traffic flowing to a server.