Password cracking / rainbow tables

Plaintext recovered from stolen hashes offline

categoryIdentity, authentication and credential attacksseverityMediumdetectability (measured in our lab)Mediumlabdetected in lab

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1110.002 · Password Cracking with Hashcat · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1110.002 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1110.002 -TestGuids 6d27df5d-69d4-4c91-bc33-5983ffe91692 -GetPrereqs; Invoke-AtomicTest T1110.002 -TestGuids 6d27df5d-69d4-4c91-bc33-5983ffe91692 -TimeoutSeconds 120'

ATT&CK T1110.002 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1110.002 -Tool atomic -RunId run-2026-11-02-006 -Command 'Invoke-AtomicTest T1110.002 -TestGuids 6d27df5d-69d4-4c91-bc33-5983ffe91692 -GetPrereqs; Invoke-AtomicTest T1110.002 -TestGuids 6d27df5d-69d4-4c91-bc33-5983ffe91692 -TimeoutSeconds 120'

ATT&CK T1110.002 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1110.002 -Tool atomic -RunId run-2026-11-02-012 -Command 'Invoke-AtomicTest T1110.002 -TestGuids 6d27df5d-69d4-4c91-bc33-5983ffe91692 -GetPrereqs; Invoke-AtomicTest T1110.002 -TestGuids 6d27df5d-69d4-4c91-bc33-5983ffe91692 -TimeoutSeconds 120'

What our lab measured

detected windows · 2026-11-02 · detected in 49s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Password cracking tool executed: hashcat run with an attack/hash mode -- T1110.002
Sysmon · EID 1	Powershell process spawned Windows command shell instance
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 11	Executable file created by powershell: C:\AtomicRedTeam\ExternalPayloads\7z1900.exe
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell executed "Get-Content -Stream or Invoke-Expresion". Possible string execution as code
PowerShell · EID 4104	Powershell script querying system environment variables
… and 6 more event type(s)

Detection that fired

✓ Wazuh 100468 (level 10) lab rule — Password cracking tool executed: hashcat run with an attack/hash mode -- T1110.002
✓ Wazuh 100469 (level 10) lab rule — Password cracking tool executed: hashcat run with an attack/hash mode (Security 4688 arm) -- T1110.002

Plus 12 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~1800 incidental alerts/hour — tune against this.

partially detected windows · 2026-11-02

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell process spawned Windows command shell instance
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 1	Windows command prompt started by an abnormal process
Sysmon · EID 11	Executable file created by powershell: C:\AtomicRedTeam\ExternalPayloads\7z1900.exe
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell executed "Get-Content -Stream or Invoke-Expresion". Possible string execution as code
PowerShell · EID 4104	Powershell script querying system environment variables
… and 8 more event type(s)

Plus 16 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~4664 incidental alerts/hour — tune against this.

Classification

29 values: 9 reviewed, 3 lab-measured, 12 imported, 5 derived. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	None
User interaction	None
Attacker skill required	Low
Resources required	Medium
Likelihood / prevalence	Medium
Maturity	Commoditized

Impact & scope

Severity	Medium
Impact	Confidentiality
Platform	Identity ProviderLinuxmacOSNetwork DevicesOffice SuiteWindows
Environment	CloudOn-premises
Target asset class	Identity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	Low
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	File AccessFile CreationProcess AccessProcess CreationUser Account Authentication

Detection & response

Mitigated by 16

M1027 attack-mitigation
M1032 attack-mitigation
D3-ANCI d3fend
D3-CCSA d3fend
D3-CDP d3fend
D3-CH d3fend
D3-CR d3fend
D3-CRO d3fend
D3-CTS d3fend
D3-DUC d3fend
D3-MFA d3fend
D3-OTP d3fend
D3-PR d3fend
D3-PWA d3fend
D3-RIC d3fend
D3-SPP d3fend

Detected by 4

DET0105 attack-detection-strategy
39b31e81-5f5f-4898-9c0e-2160cfc0f9bf sigma
100468 wazuh
100469 wazuh

Tested by 1

6d27df5d-69d4-4c91-bc33-5983ffe91692 atomic

Attack relationships

Parent: Broken authentication (API)
Parent: WPS PIN brute force

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-11-02-012`	partially-detected	atomic	windows	2026-11-02
`run-2026-11-02-016`	detected	atomic	windows	2026-11-02

run-2026-11-02-012 — Backlog detectability-baseline probe (priority 7, 4 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1110.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=0 incidental=171 max_level=15 dwell_s=90
run-2026-11-02-016 — Backlog detectability-baseline probe (priority 7, 4 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1110.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy. [renumbered from run-2026-11-02-006 on commit: the harness reused that id because the prereq-only run-2026-11-02-006 lives in lab/results-excluded/]; expected=2 incidental=57 max_level=15 dwell_s=90

Framework references

Primary source: https://attack.mitre.org/techniques/T1110/
attack: T1110.002 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 318 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 7 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-012 (partially-detected) for T1110.002: no alert matched the expected technique
ev-0004 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-016 (detected): Wazuh rule(s) 100468, 100469 fired on T1110.002 within the detonation window
Password cracking tool executed: hashcat run with an attack/hash mode -- T1110.002