{"id":"T1110.002","name":"Password Cracking","url":"https://attack.mitre.org/techniques/T1110/002","tactics":["credential-access"],"platforms":["Identity Provider","Linux","macOS","Network Devices","Office Suite","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0105","stix_id":"x-mitre-detection-strategy--ee07e9eb-8438-4c7c-8260-88a09fbe98de","name":"Post-Credential Dump Password Cracking Detection via Suspicious File Access and Hash Analysis Tools","url":"https://attack.mitre.org/detectionstrategies/DET0105","analytics":[{"id":"AN0292","stix_id":"x-mitre-analytic--d2a45051-b999-4969-aeb0-d7f83d453976","name":"Analytic 0292","description":"Use of hash-cracking tools (e.g., John the Ripper, Hashcat) after credential dumping, combined with high CPU usage or GPU invocation via unsigned binaries accessing password hash files","url":"https://attack.mitre.org/detectionstrategies/DET0105#AN0292","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"HashToolName","description":"Match execution against known cracking toolnames like hashcat.exe, john.exe, etc."},{"field":"FilePathIndicators","description":"Watch for access to common hash dump locations (e.g., SAM, SYSTEM, NTDS.dit)"},{"field":"ExecutionContext","description":"Run context: local interactive user vs. scheduled task or remote session"}],"live":true,"detection_strategies":["DET0105"],"techniques":["T1110.002"]},{"id":"AN0293","stix_id":"x-mitre-analytic--7efdc4e3-8a2e-4d0d-8ced-03155f2c55ac","name":"Analytic 0293","description":"Execution of hash cracking binaries or scripts (e.g., john, hashcat) following access to shadow file or dumped hashes","url":"https://attack.mitre.org/detectionstrategies/DET0105#AN0293","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"auth.log or custom tool logs","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"ShadowAccessPattern","description":"Access to /etc/shadow or known dumped hash files"},{"field":"CrackingBinaryPath","description":"Tool path or name associated with hash cracking"},{"field":"CPUUsageThreshold","description":"Sustained CPU load post-credential dump can be an indicator"}],"live":true,"detection_strategies":["DET0105"],"techniques":["T1110.002"]},{"id":"AN0294","stix_id":"x-mitre-analytic--3682e3c9-33a7-4328-b0c5-73c8bbcb9b53","name":"Analytic 0294","description":"Unsigned or scripting-based processes invoking password cracking binaries or accessing hashed credential artifacts post-login","url":"https://attack.mitre.org/detectionstrategies/DET0105#AN0294","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process and file events via log stream","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"UnsignedBinaryPath","description":"Path to untrusted binaries launched by user"},{"field":"UserPrivilegeLevel","description":"Helps distinguish between system and user-launched activity"}],"live":true,"detection_strategies":["DET0105"],"techniques":["T1110.002"]},{"id":"AN0295","stix_id":"x-mitre-analytic--0084089f-6e5f-42c4-8b0d-78e95cd55d0f","name":"Analytic 0295","description":"Sudden valid logins from accounts that previously had credentials dumped but had not authenticated successfully in the past; correlated with timeline of suspected hash cracking","url":"https://attack.mitre.org/detectionstrategies/DET0105#AN0295","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:signinlogs","channel":"Success logs from high-risk accounts","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"azure-signinlogs"}],"mutable_elements":[{"field":"PostDumpTimeWindow","description":"Detection window after credential dumping to watch for successful logins"},{"field":"LoginLocationRisk","description":"Use IP/geolocation risk scoring to flag unusual access"}],"live":true,"detection_strategies":["DET0105"],"techniques":["T1110.002"]},{"id":"AN0296","stix_id":"x-mitre-analytic--029db14d-fb94-49ee-9d6d-3c7212671377","name":"Analytic 0296","description":"Offline cracking inferred by subsequent successful CLI or web-based authentications into routers or switches from previously dumped accounts","url":"https://attack.mitre.org/detectionstrategies/DET0105#AN0296","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"config access, authentication logs","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"LogonTimeCorrelation","description":"Window to link credential theft and reuse"},{"field":"SourceDeviceTag","description":"Filters based on where cracking may have occurred externally"}],"live":true,"detection_strategies":["DET0105"],"techniques":["T1110.002"]}],"live":true,"version":"1.0","techniques":["T1110.002"]}],"sigma_rules":[{"id":"39b31e81-5f5f-4898-9c0e-2160cfc0f9bf","title":"HackTool - Hashcat Password Cracker Execution","author":"frack113","status":"test","level":"high","date":"2021-12-27","modified":"2023-02-04","description":"Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.002/T1110.002.md#atomic-test-1---password-cracking-with-hashcat","https://hashcat.net/wiki/doku.php?id=hashcat"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1110.002"],"path":"rules/windows/process_creation/proc_creation_win_hktl_hashcat.yml","techniques":["T1110.002"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}