Smart Brutforce?

[undeath]

You can use PACK to match a specific password policy or play around with hashcat's mask attack and the -t argument. Unfortunately with -t it's not possible to later resume an attack by using a higher threshold.