HackTool - CrackMapExec Execution Patterns

Title: HackTool - CrackMapExec Execution Patterns
Status: stable
Description:Detects various execution patterns of the CrackMapExec pentesting framework
References:
  -https://github.com/byt3bl33d3r/CrackMapExec
Author: Thomas Patzke
Date: 2020-05-22
modified:2023-11-06
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.t1047'
• -'attack.t1053'
• -'attack.t1059.003'
• -'attack.t1059.001'
• -'attack.s0106'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains:
      -'cmd.exe /Q /c * 1> \\\\*\\*\\* 2>&1'
      -'cmd.exe /C * > \\\\*\\*\\* 2>&1'
      -'cmd.exe /C * > *\\Temp\\* 2>&1'
      -'powershell.exe -exec bypass -noni -nop -w 1 -C "'
      -'powershell.exe -noni -nop -w 1 -enc '

  condition:selection
Falsepositives:
  -Unknown
Level: high