BIOC
Medium
✕
Hash cracking using Hashcat tool
Hash cracking allows attackers to collect passwords and use them later on as part of their operation.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: OS Credential Dumping (T1003)
Indicator:
Process action type = execution AND target process cmd = * -m* , * --hash-type* , * -a* , * --attack-mode* , *.txt* AND target process name = hashcat*
Preventable: yes