Password Hash List Downloaded for Offline Cracking

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to download files that appear to be password hash lists or wordlists, often used for offline credential cracking. It specifically looks for HTTP URIs containing keywords like 'rockyou', 'passwords', 'wordlist', or 'hashlist' followed by '.txt', and only triggers if the downloaded file size is greater than 10,000 bytes. This activity is indicative of an attacker attempting to exfiltrate or acquire data for credential access.