Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,427
11,813
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects execution of Mimikatz or LSASS process memory credential theft techniques that are preceded by common discovery tools (such as nltest, net, adcmd, netexec, or kerbrute) on the same device within a 24-hour window.
Detects an inbound public network or remote interactive logon to a device, followed within 24 hours by credential-dumping activity, and subsequently within 7 days by email data staging (creation or modification of PST, OST, EML, or MBOX files) on the same device.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects NTDSUtil commands associated with Active Directory database export, installation media preparation, and snapshot creation, which may facilitate offline credential extraction.
Detects unauthorized access to virtual hard disk (VMDK) files by non-standard processes followed by the creation or modification of sensitive offline credential artifacts such as ntds.dit or SYSTEM hives on the same host within a 2-hour window, indicating potential offline credential theft.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Detects the execution of known credential theft tools such as Mimikatz, SharpDecryptPwd, and WebBrowserPassView via EDR process creation telemetry.
The following analytic detects the behavior of dumping credentials from memory by exploiting the Local Security Authority Subsystem Service (LSASS) using the comsvcs.dll and MiniDump via rundll32. This detection leverages process information from Endpoint Detection and Response (EDR) logs, focusing on specific command-line executions. This activity is significant because it indicates potential credential theft, which can lead to broader system compromise, persistence, lateral movement, and privilege escalation. If confirmed malicious, attackers could gain unauthorized access to sensitive information, leading to data theft, ransomware attacks, or other damaging outcomes.
The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager.
It leverages Sysmon EventID 11 to identify file creation events where the target filename matches *lsass*.dmp.
This activity is significant because creating an lsass dump can be a precursor to credential theft, as the dump file contains sensitive information such as user passwords.
It leverages Sysmon EventID 11 to identify file creation events where the target filename matches *lsass*.dmp.
This activity is significant because creating an lsass dump can be a precursor to credential theft, as the dump file contains sensitive information such as user passwords.
The following analytic detects attempts to read LSASS memory, indicative of credential dumping.
It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe.
It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe.
The following analytic detects the use of `reg.exe` to export Windows Registry hives, which may contain sensitive credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving `save` or `export` actions targeting the `sam`, `system`, or `security` hives. This activity is significant as it indicates potential offline credential access attacks, often executed from untrusted processes or scripts. If confirmed malicious, attackers could gain access to credential data, enabling further compromise and lateral movement within the network.
The following analytic detects possible credential dumping by identifying suspicious process access to LSASS with credential-dumping-related call traces.
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40).
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40).
The following analytic detects attempts to access or dump the contents of /etc/passwd and /etc/shadow files on Linux systems. It leverages data from Linux Auditd, focusing on processes like 'cat', 'nano', 'vim', and 'vi' accessing these files. This activity is significant as it may indicate credential dumping, a technique used by adversaries to gain persistence or escalate privileges. If confirmed malicious, privileges. If confirmed malicious, attackers could obtain hashed passwords for offline cracking, leading to unauthorized access and potential system compromise.
The following analytic detects the use of Ntdsutil to export the Active Directory database (NTDS.dit). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because exporting NTDS.dit can be a precursor to offline password cracking, posing a severe security risk. If confirmed malicious, an attacker could gain access to sensitive credentials, potentially leading to unauthorized access and privilege escalation within the network.
The following analytic detects the use of CreateDump.exe to perform a process dump. This binary is not native to Windows and is often introduced by third-party applications, including PowerShell 7. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and complete command-line executions. This activity is significant as it may indicate an attempt to dump LSASS memory, which can be used to extract credentials. If confirmed malicious, this could lead to unauthorized access and lateral movement within the network.
Detects unauthorized or suspicious use of the DsGetNCChanges (opnum 3) function on the DRSUAPI interface. This RPC method is commonly abused in DCSync attacks to replicate domain controller data, including sensitive password hashes, from an Active Directory environment.
This rule detects unauthorized directory replication requests (DRSUAPI) using Active Directory Event ID 4662. It specifically monitors for access requests to sensitive directory replication object GUIDs (Get-Changes / Get-Changes-All) where the requesting user account is not a domain controller computer account. This behavior is a common indicator of DCSync credential dumping attacks performed by tools like Mimikatz or Impacket.
The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. It leverages Sysmon logs, specifically EventCode 10, to identify suspicious call traces to dbgcore.dll and dbghelp.dll associated with lsass.exe. This activity is significant as it often precedes the theft of sensitive login credentials, posing a high risk of unauthorized access to systems and data. If confirmed malicious, attackers could gain access to critical credentials, enabling further compromise and lateral movement within the network.
Page 1 of 38