AN0292
Analytic 0292
Windows
Use of hash-cracking tools (e.g., John the Ripper, Hashcat) after credential dumping, combined with high CPU usage or GPU invocation via unsigned binaries accessing password hash files
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=10
[HashToolName]
Match execution against known cracking toolnames like hashcat.exe, john.exe, etc.
[FilePathIndicators]
Watch for access to common hash dump locations (e.g., SAM, SYSTEM, NTDS.dit)
[ExecutionContext]
Run context: local interactive user vs. scheduled task or remote session
AN0293
Analytic 0293
Linux
Execution of hash cracking binaries or scripts (e.g., john, hashcat) following access to shadow file or dumped hashes
auditd:SYSCALL
execve
linux:syslog
auth.log or custom tool logs
[ShadowAccessPattern]
Access to /etc/shadow or known dumped hash files
[CrackingBinaryPath]
Tool path or name associated with hash cracking
[CPUUsageThreshold]
Sustained CPU load post-credential dump can be an indicator
AN0294
Analytic 0294
macOS
Unsigned or scripting-based processes invoking password cracking binaries or accessing hashed credential artifacts post-login
macos:unifiedlog
process and file events via log stream
[UnsignedBinaryPath]
Path to untrusted binaries launched by user
[UserPrivilegeLevel]
Helps distinguish between system and user-launched activity
AN0295
Analytic 0295
Identity Provider
Sudden valid logins from accounts that previously had credentials dumped but had not authenticated successfully in the past; correlated with timeline of suspected hash cracking
azure:signinlogs
Success logs from high-risk accounts
[PostDumpTimeWindow]
Detection window after credential dumping to watch for successful logins
[LoginLocationRisk]
Use IP/geolocation risk scoring to flag unusual access
AN0296
Analytic 0296
Network Devices
Offline cracking inferred by subsequent successful CLI or web-based authentications into routers or switches from previously dumped accounts
networkdevice:syslog
config access, authentication logs
[LogonTimeCorrelation]
Window to link credential theft and reuse
[SourceDeviceTag]
Filters based on where cracking may have occurred externally