rules/windows/process_creation/proc_creation_win_hack_hydra.yml

title: Hydra Password Guessing Hack Tool
id: aaafa146-074c-11eb-adc1-0242ac120002
status: test
description: Detects command line parameters used by Hydra password guessing hack tool
author: Vasiliy Burov
references:
  - https://github.com/vanhauser-thc/thc-hydra
  - https://attack.mitre.org/techniques/T1110/001/
date: 2020/10/05
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains|all:
      - '-u '
      - '-p '
  selection2:
    CommandLine|contains:
      - '^USER^'
      - '^PASS^'
  condition: selection1 and selection2
falsepositives:
  - Software that uses the caret encased keywords PASS and USER in its command line
level: high
tags:
  - attack.credential_access
  - attack.t1110
  - attack.t1110.001
Create win_hack_hydra.yml 2020-10-05 23:05:27 +03:00			`title: Hydra Password Guessing Hack Tool`
Update win_hack_hydra.yml 2020-10-05 23:52:55 +03:00			`id: aaafa146-074c-11eb-adc1-0242ac120002`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Create win_hack_hydra.yml 2020-10-05 23:05:27 +03:00			`description: Detects command line parameters used by Hydra password guessing hack tool`
			`author: Vasiliy Burov`
			`references:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- https://github.com/vanhauser-thc/thc-hydra`
			`- https://attack.mitre.org/techniques/T1110/001/`
Create win_hack_hydra.yml 2020-10-05 23:05:27 +03:00			`date: 2020/10/05`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`modified: 2021/11/27`
Create win_hack_hydra.yml 2020-10-05 23:05:27 +03:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`category: process_creation`
			`product: windows`
Create win_hack_hydra.yml 2020-10-05 23:05:27 +03:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection1:`
			`CommandLine\|contains\|all:`
			`- '-u '`
			`- '-p '`
			`selection2:`
			`CommandLine\|contains:`
			`- '^USER^'`
			`- '^PASS^'`
			`condition: selection1 and selection2`
Create win_hack_hydra.yml 2020-10-05 23:05:27 +03:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Software that uses the caret encased keywords PASS and USER in its command line`
Create win_hack_hydra.yml 2020-10-05 23:05:27 +03:00			`level: high`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`tags:`
			`- attack.credential_access`
			`- attack.t1110`
			`- attack.t1110.001`