1200KM / detection
T1110.002 Password Cracking — Detection Rules
Detection workspace for T1110.002 Password Cracking: 1 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- HackTool - Hashcat Password Cracker Execution · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0105 Post-Credential Dump Password Cracking Detection via Suspicious File Access and Hash Analysis Tools
AN0292 Analytic 0292
Use of hash-cracking tools (e.g., John the Ripper, Hashcat) after credential dumping, combined with high CPU usage or GPU invocation via unsigned binaries accessing password hash files
AN0293 Analytic 0293
Execution of hash cracking binaries or scripts (e.g., john, hashcat) following access to shadow file or dumped hashes
AN0294 Analytic 0294
Unsigned or scripting-based processes invoking password cracking binaries or accessing hashed credential artifacts post-login
AN0295 Analytic 0295
Sudden valid logins from accounts that previously had credentials dumped but had not authenticated successfully in the past; correlated with timeline of suspected hash cracking
AN0296 Analytic 0296
Offline cracking inferred by subsequent successful CLI or web-based authentications into routers or switches from previously dumped accounts
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.