Password Auditing & Defensive Tools

2.1 Short catalogue — tool names & legitimate uses

• Hashcat — password-auditing toolkit (official docs)
  GPU-accelerated password/hash analysis used for offline hash auditing and measuring KDF resistance (authorized contexts).
  Note ?
• John the Ripper
  A versatile offline password auditor supporting many hash formats for password-strength assessments.
• RainbowCrack / Ophcrack
  Precomputed table approach (time–memory trade-off) historically used to reverse unsalted hashes; highlights why salts matter.
• THC-Hydra / Medusa
  Network authentication testers for testing remote auth policies (rate limits, lockouts) — only in-scope and authorized tests.
• Aircrack-ng suite
  Wireless assessment suite used in authorized Wi-Fi audits to validate configuration and defenses.
• Metasploit Framework
  Modular penetration-testing framework used for emulation and validating mitigations in scoped engagements.
• Wordlist generators and examples (use synthetic or vendor-supplied test lists; avoid leaked datasets).
  Tools and lists to generate candidate passwords for simulation and risk measurement.

3.1 Telemetry fields to collect

• timestamp, host, process_name, process_cmdline, user, parent_process — link suspicious processes to accounts and hosts.
• cpu_percent, gpu_util, open_files, file_hash — detect high resource usage related to cracking or large file access.
• auth_event (username, src_ip, result, failure_count) — detect brute-force patterns.
• Network connection logs and (authorized) pcap to catch injection or deauth behaviours for Wi-Fi tests.

3.2 High-level detection rule templates (pseudocode)

Use these as conceptual templates and convert to your product's query language (Splunk, Elastic, Sigma, etc.).

• Unusual GPU usage: If cpu_percent > X AND gpu_util > Y on a non-lab host for > T minutes → Investigate process and file activity.
• Mass authentication failures: If auth_failure_count > N within M minutes for a user or source IP → Alert / block / require MFA.
• Large offline hash export: If file access matches \.(sam|ntds|sql|dump)$ AND exported externally → High-priority containment.
• Wi-Fi injection / deauth: If deauth frame rate > threshold on managed APs → Alert for injection or rogue actor.

3.3 Tuning and false positives

Start with conservative thresholds in production and validate/tune in a lab. Correlate multiple signals (resource usage + file access + network egress) before taking automated containment actions.