cscli scenarios install sigmahq/proc_creation_win_hktl_crackmapexec_execution1type: trigger2name: sigmahq/proc_creation_win_hktl_crackmapexec_execution3description: |4 This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Image endsWith '\\crackmapexec.exe' || evt.Parsed.CommandLine contains ' -M pe_inject ' || evt.Parsed.CommandLine contains ' --local-auth' && evt.Parsed.CommandLine contains ' -u ' && evt.Parsed.CommandLine contains ' -x ' || evt.Parsed.CommandLine contains ' --local-auth' && evt.Parsed.CommandLine contains ' -u ' && evt.Parsed.CommandLine contains ' -p ' && evt.Parsed.CommandLine contains ' -H \'NTHASH\'' || evt.Parsed.CommandLine contains ' mssql ' && evt.Parsed.CommandLine contains ' -u ' && evt.Parsed.CommandLine contains ' -p ' && evt.Parsed.CommandLine contains ' -M ' && evt.Parsed.CommandLine contains ' -d ' || evt.Parsed.CommandLine contains ' smb ' && evt.Parsed.CommandLine contains ' -u ' && evt.Parsed.CommandLine contains ' -H ' && evt.Parsed.CommandLine contains ' -M ' && evt.Parsed.CommandLine contains ' -o ' || evt.Parsed.CommandLine contains ' smb ' && evt.Parsed.CommandLine contains ' -u ' && evt.Parsed.CommandLine contains ' -p ' && evt.Parsed.CommandLine contains ' --local-auth' || evt.Parsed.CommandLine contains ' --local-auth' && evt.Parsed.CommandLine contains ' -u ' && evt.Parsed.CommandLine contains ' -p ' && evt.Parsed.CommandLine contains ' 10.' && evt.Parsed.CommandLine contains ' 192.168.' && evt.Parsed.CommandLine contains '/24 ')7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t104715 - attack.t105316 - attack.t1059.00317 - attack.t1059.00118 - attack.t111019 - attack.t12012021 label: "HackTool - CrackMapExec Execution"22 behavior : "windows:audit"23 remediation: false2425scope:26 type: ParentProcessId27 expression: evt.Parsed.ParentProcessId2829