cscli scenarios install sigmahq/proc_creation_win_hktl_crackmapexec_execution_patterns1type: trigger2name: sigmahq/proc_creation_win_hktl_crackmapexec_execution_patterns3description: |4 Detects various execution patterns of the CrackMapExec pentesting framework5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (Match('cmd.exe /Q /c 1> \\\\\\\\ 2>&1', evt.Parsed.CommandLine) || Match('cmd.exe /C > \\\\\\\\ 2>&1', evt.Parsed.CommandLine) || Match('cmd.exe /C > \\Temp\\ 2>&1', evt.Parsed.CommandLine) || evt.Parsed.CommandLine contains 'powershell.exe -exec bypass -noni -nop -w 1 -C "' || evt.Parsed.CommandLine contains 'powershell.exe -noni -nop -w 1 -enc ')7blackhole: 2m8#status: stable9labels:10 service: windows11 confidence: 212 spoofable: 013 classification:14 - attack.t104715 - attack.t105316 - attack.t1059.00317 - attack.t1059.0011819 label: "HackTool - CrackMapExec Execution Patterns"20 behavior : "windows:audit"21 remediation: false2223scope:24 type: ParentProcessId25 expression: evt.Parsed.ParentProcessId2627