HackTool - Hashcat Password Cracker Execution

Title: HackTool - Hashcat Password Cracker Execution
Status: test
Description:Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.002/T1110.002.md#atomic-test-1---password-cracking-with-hashcat
  -https://hashcat.net/wiki/doku.php?id=hashcat
Author: frack113
Date: 2021-12-27
modified:2023-02-04
Tags:

• -'attack.credential-access'
• -'attack.t1110.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    Image|endswith: '\hashcat.exe'
  selection_cli:
    CommandLine|contains|all:
      -'-a '
      -'-m 1000 '
      -'-r '

  condition:1 of selection_*
Falsepositives:
  -Tools that use similar command line flags and values
Level: high