Sigma rule: HackTool - CrackMapExec File Indicators

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-6e981d5f9ada, updated 2024-06-27T00:00:00.000Z.

Rule

Title
HackTool - CrackMapExec File Indicators
Status
test
Level
high
Author
Nasreddine Bencherchali (Nextron Systems)
Date
2024-03-11
Modified
2024-06-27
File
rules/windows/file/file_event/file_event_win_hktl_crackmapexec_indicators.yml
Commit
ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects file creation events with filename patterns used by CrackMapExec.

Log source

product
windows
category
file_event

Detection

selection_path:
    TargetFilename|startswith: 'C:\Windows\Temp\' # The disk extension is hardcoded in the tool.
selection_names_str:
    TargetFilename|endswith:
        - '\temp.ps1' # https://github.com/byt3bl33d3r/CrackMapExec/blob/3c3e412193cb6d3237abe90c543e5d995bfa4447/cme/modules/keepass_trigger.py#L42C41-L42C68
        - '\msol.ps1' # https://github.com/byt3bl33d3r/CrackMapExec/blob/3c3e412193cb6d3237abe90c543e5d995bfa4447/cme/modules/msol.py#L48C98-L48C106
selection_names_re:
    - TargetFilename|re: '\\[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.txt$' # https://github.com/byt3bl33d3r/CrackMapExec/blob/3c3e412193cb6d3237abe90c543e5d995bfa4447/cme/protocols/wmi/wmiexec.py#L86
    - TargetFilename|re: '\\[a-zA-Z]{8}\.tmp$' # https://github.com/byt3bl33d3r/CrackMapExec/blob/3c3e412193cb6d3237abe90c543e5d995bfa4447/cme/protocols/smb/atexec.py#L145C19-L146
condition: selection_path and 1 of selection_names_*

False positives (as the rule lists them)

  • Unknown

Tags

  • attack.credential-access
  • attack.t1003.001

MITRE ATT&CK ids this rule names

Related rules

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_hktl_crackmapexec_indicators.yml

Sources and licences

  • SigmaHQ

    "HackTool - CrackMapExec File Indicators" by Nasreddine Bencherchali (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_hktl_crackmapexec_indicators.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: HackTool - CrackMapExec File Indicators",
entity page, dataset version ref-6e981d5f9ada, updated 2024-06-27T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/736ffa74-5f6f-44ca-94ef-1c0df4f51d2a (accessed 2026-11-03).
Underlying source: SigmaHQ rule 736ffa74-5f6f-44ca-94ef-1c0df4f51d2a, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.