# Source: https://docs.datadoghq.com/security/default_rules/def-000-0n1.md

---
title: Windows CrackMapExec execution patterns
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Windows CrackMapExec execution patterns
---

# Windows CrackMapExec execution patterns

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attackTactic:[TA0002-execution](https://attack.mitre.org/tactics/TA0002)Technique:[T1059-command-and-scripting-interpreter](https://attack.mitre.org/techniques/T1059) 
## Goal{% #goal %}

Detects command line patterns associated with CrackMapExec execution, a post-exploitation tool commonly used for lateral movement within Windows environments.

## Strategy{% #strategy %}

This rule monitors Windows event logs for specific command line patterns that are characteristic of CrackMapExec usage. The detection focuses on distinctive command execution patterns commonly employed by CrackMapExec when it executes commands on remote systems via Windows Management Instrumentation (WMI), scheduled tasks, or PowerShell. These command structures are specifically designed to capture the output of executed commands and return it to the attacker while minimizing user visibility.

## Triage & Response{% #triage--response %}

- Examine the full command line content to understand what actions were executed on `{{host}}`.
- Analyze the context of the execution, including the user account that initiated the command and the process ancestry.
- Review network connections established around the time of execution to identify potential lateral movement attempts.
- Check for other indicators of compromise such as suspicious PowerShell scripts, unexpected scheduled tasks, or unusual WMI operations.
- Investigate which systems the affected host communicated with around the time of detection.