Detection of Hashcat Password Cracker Execution

Hashcat is a widely used advanced password recovery tool that supports various hashing algorithms. In offensive operations, adversaries utilize Hashcat to crack password hashes extracted from compromised systems, such as SAM database exports or NTDS.dit files. Defenders must monitor for the execution of hashcat.exe, particularly when used in conjunction with command-line arguments specifying attack modes (-a), hash types (-m), or rule-based cracking files (-r). While legitimate security assessments and authorized penetration tests employ this tool, its presence on endpoints often signals active credential access or post-exploitation activity where an attacker has already successfully bypassed system-level protections to obtain credentials.

Impact

Successful execution of Hashcat by unauthorized actors leads to the recovery of plaintext passwords, facilitating lateral movement, privilege escalation, and persistent access to the organization's network.

Recommendation

• Deploy the provided Sigma rule to detect unauthorized Hashcat process creation events.
• Investigate any detected execution of hashcat.exe to determine if it aligns with authorized penetration testing or security assessment activity.
• Proactively secure sensitive credential stores such as the SAM registry hive and NTDS.dit file by implementing strict access control lists and monitoring for unauthorized file access.