defection.io

tool

CrackMapExec S0488

Type: tool
Platform: Windows
Created: 17 July 2020
Last modified: 14 March 2024

CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. CrackMapExec collects Active Directory information to conduct lateral movement through targeted networks.[1]

TechniquesTop 20%

Tactics68th pct

Threat groupsunranked

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

tool

CrackMapExec S0488

Type: tool
Platform: Windows
Created: 17 July 2020
Last modified: 14 March 2024

TechniquesTop 20%

Tactics68th pct

Threat groupsunranked

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

CrackMapExec MITRE reference S0488

Security Account Manager T1003.002 ↗

CrackMapExec can dump usernames and hashed passwords from the SAM.2

Credential Access36 detection rules

NTDS T1003.003 ↗

CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.3

Credential Access30 detection rules

LSA Secrets T1003.004 ↗

CrackMapExec can dump hashed passwords from LSA secrets for the targeted system.4

Credential Access13 detection rules

System Network Configuration Discovery T1016 ↗

CrackMapExec can collect DNS information from the targeted system.5

Discovery25 detection rules

Remote System Discovery T1018 ↗

CrackMapExec can discover active IP addresses, along with the machine name, within a targeted network.6

Discovery39 detection rules

Windows Management Instrumentation T1047 ↗

CrackMapExec can execute remote commands using Windows Management Instrumentation.7

Execution71 detection rules

Standing S0488

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques20Top 20%

80th percentile · 80% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics768th pct

68th percentile · 68% of 825 ATT&CK software entries have this many tactics spanned or fewer.

Threat groups561% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaign185% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique29.5med74th pct

74th percentile · 74% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique9.5medTop 16%

84th percentile · 84% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique2medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 20 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 1Sigma rules (cumulative) · 547Splunk ESCU (cumulative) · 353