Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects PowerShell script block text that contains commands indicative of searching for credentials in files. Specifically, it looks for the combination of 'ls' (list directory contents), '-R' (recursive search), 'select-string' (finds text in strings and files), and '-Pattern' (specifies the text pattern to find). This combination suggests an adversary is recursively searching files for specific patterns, likely credentials.
This rule detects the creation of a symbolic link (symlink) to a Volume Shadow Copy using the 'mklink' command-line utility. Adversaries often create symlinks to shadow copies to access and exfiltrate sensitive data, such as credential hashes from the Security Account Manager (SAM) database or the Active Directory database (NTDS.dit), without directly interacting with the live system files. This technique is commonly used as part of credential dumping activities.
Detects the execution of tools from SecurityXploded, specifically focusing on 'PasswordDump.exe'. These tools are often used for credential dumping, which involves extracting credentials from various password stores on a system.
Detects the execution of WebBrowserPassView.exe, a password recovery tool that reveals passwords stored by various web browsers including Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera. This tool is often used by adversaries to extract credentials from compromised systems.
This rule detects attempts to enumerate credentials stored in the Windows Registry using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query for string values (`/t REG_SZ`) recursively (`/s`) within the HKLM (Local Machine) or HKCU (Current User) hives, or specifically targets the PuTTY sessions key in HKCU. This activity is indicative of an adversary searching for insecurely stored credentials that can be used for further access.
This rule detects the use of 'PromptForCredential' within PowerShell script block logs. This function is used to display a dialog box that prompts the user for credentials, which can be abused by adversaries to harvest user credentials. Detection relies on PowerShell Script Block Logging being enabled.
This rule detects the execution of a PowerShell command containing 'Get-Process lsass' within a script block. This command is commonly used by attackers to identify the LSASS process ID before attempting to dump its memory for credential harvesting. The detection relies on PowerShell Script Block Logging being enabled.
Detects suspicious access to the Local Security Authority Subsystem Service (LSASS) process memory. This rule specifically looks for access to 'lsass.exe' originating from 'svchost.exe' with a specific suspicious access right ('0x14c0') and a call trace indicating 'seclogon.dll'. This combination suggests an attempt to dump LSASS memory, potentially to steal credentials.
Detects a possible process memory dump of LSASS using processes with whitelisted filenames (like TrolleyExpress.exe, ProcessDump.exe, dump64.exe) to evade detection by security products like Microsoft Defender. The rule specifically looks for access to lsass.exe with granted access rights commonly associated with memory dumping.
Detects the usage of 'pypykatz' to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored. The rule specifically looks for the execution of 'pypykatz.exe' or 'python.exe' with command-line arguments indicating 'live' and 'registry' access, which are common parameters for dumping credentials from the live registry hive.
Detects the execution of the hacktool SafetyKatz, which is used for credential dumping, by identifying its executable name, original file name, or description in process creation events.
Detects the execution of the SharpImpersonation tool, which is used for manipulating tokens on Windows systems. This can occur remotely via tools like PsExec/WmiExec or interactively. The rule specifically looks for the executable name or command-line arguments indicating token manipulation techniques such as 'CreateProcessAsUserW' or 'ImpersonateLoggedOnUser', often combined with 'user:' and 'binary:' or 'shellcode:' parameters.
This rule detects suspicious PowerShell scripts attempting to copy the Security Account Manager (SAM) database. It specifically looks for PowerShell command lines that include both a reference to a volume shadow copy (e.g., '\HarddiskVolumeShadowCopy') and the SAM file path ('System32\config\sam'), combined with common PowerShell copy commands or .NET file copy methods. This activity is indicative of an adversary trying to extract credentials by accessing the SAM database, often from a shadow copy to bypass file locks.
Detects the execution of 'ditsnap.exe', a tool used to inspect the Active Directory database (ntds.dit). This tool can be used by adversaries to dump credentials from a domain controller.
Detects suspicious invocation of the Get-ADDBAccount PowerShell script that reads from an ntds.dit file. This technique can be used to gain access to credentials without relying on traditional credential dumping tools. The rule specifically looks for the presence of 'Get-ADDBAccount', 'BootKey', and 'DatabasePath' in the PowerShell payload, indicating an attempt to extract credentials from an NTDS database file.
This rule detects the use of the built-in Windows 'copy' command via 'cmd.exe' to transfer files with '.dmp', '.dump', or '.hdmp' extensions from a remote network share (indicated by '\\') to a local system. This activity is often associated with credential dumping techniques where memory dumps (e.g., LSASS process memory dumps) containing sensitive information are exfiltrated or staged.
This rule detects attempts to bypass Windows Defender by renaming a legitimate tool, specifically `procdump`, to `dump64.exe` and placing it within a Microsoft Visual Studio installation directory. This technique is often used to dump LSASS memory for credential access.
This rule detects common flag combinations used by CrackMapExec, a post-exploitation tool, to identify its execution even if the binary name has been changed. It looks for specific command-line arguments related to local authentication, hash-based authentication, and module usage for SMB and MSSQL protocols.
This rule detects the use of PowerShell's `Get-Process` cmdlet or its aliases (`ps`, `gps`) specifically targeting the `lsass` process. Accessing the `lsass` process memory is a common technique used by attackers to dump credentials, making this activity highly suspicious and indicative of potential credential theft.
This rule detects attempts to list credentials stored in the Windows Credential Manager using the native Windows utility `vaultcmd.exe`. Specifically, it looks for process creation events where `VaultCmd.exe` is executed with the `/listcreds:` command-line argument, indicating an attempt to enumerate stored credentials.
This rule detects attempts to discover private key files using command-line tools such as `cmd.exe`, `powershell.exe`, or `findstr.exe`. It specifically looks for commands that include common private key file extensions like .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, and .asc. This activity is indicative of an adversary searching for insecurely stored credentials on a compromised system.
Page 204 of 206