Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects Active Directory replication events (Event ID 4662) targeting sensitive objects related to replication (e.g., Replication-Get-Changes-All). The rule filters out known Domain Controllers and designated replication service accounts to identify potential DCSync attacks or unauthorized directory replication attempts.
Detects the temporary enablement of the UseLogonCredential registry value by setting it to 1, followed by a subsequent reversion to 0 on the same host. This pattern is indicative of a deliberate 'hit-and-run' attempt to force the WDigest security package to store plaintext credentials in memory for harvesting.
Detects Active Directory replication events (Event ID 4662) targeting sensitive objects related to replication (e.g., Replication-Get-Changes-All). The rule filters out known Domain Controllers and designated replication service accounts to identify potential DCSync attacks or unauthorized directory replication attempts.
Detects the use of rundll32.exe to invoke the MiniDump function from comsvcs.dll, which is a well-known technique to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to a file for credential harvesting.
Detects the use of rundll32.exe to execute the MiniDump command against comsvcs.dll, a known technique used to dump process memory (such as LSASS) to a file for credential harvesting.
Detects instances where a host that is not identified as a Domain Controller performs a DRSUAPI 'DRSGetNCChanges' request against another Domain Controller. This pattern is commonly associated with DCSync attacks, where an adversary mimics the Active Directory replication process to extract password hashes.
Detects instances where a host that is not identified as a Domain Controller performs a DRSUAPI 'DRSGetNCChanges' request against another Domain Controller. This pattern is commonly associated with DCSync attacks, where an adversary mimics the Active Directory replication process to extract password hashes.
Detects suspicious Active Directory Replication Service (ADRS) requests originating from
a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.
Under normal operation, only Domain Controllers initiate replication requests carrying the
DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account
credentials — for example by abusing certificate-based authentication (PKINIT) to
impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost),
where a temporary machine account is created to request a DC certificate and then used to
perform DCSync — they can dump all domain credential material including the krbtgt hash.
a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.
Under normal operation, only Domain Controllers initiate replication requests carrying the
DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account
credentials — for example by abusing certificate-based authentication (PKINIT) to
impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost),
where a temporary machine account is created to request a DC certificate and then used to
perform DCSync — they can dump all domain credential material including the krbtgt hash.
A GitHub maintainer account related to the keyv/cacheable npm package ecosystem was compromised. The attacker published malicious versions of these packages, which affected more than 400 npm packages. The malware is designed to steal cloud credentials, developer secrets, CI/CD secrets, AI tool configuration files, and cryptocurrency wallet data. It also creates persistence using Claude Code hooks and VS Code tasks.json files, and sends stolen data to attacker-controlled GitHub repositories and C2 domains.
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Detects two distinct offensive patterns: Impacket PsExec usage, identified by a Type-3 network logon followed within 2 minutes by an ADMIN$ service installation matching typical PsExec naming patterns; and DCSync replication requests originating from non-Domain Controller accounts.
Detects two distinct offensive patterns: Impacket PsExec usage, identified by a Type-3 network logon followed within 2 minutes by an ADMIN$ service installation matching typical PsExec naming patterns; and DCSync replication requests originating from non-Domain Controller accounts.
This rule detects potentially unauthorized access or memory dumping attempts against the Local Security Authority Subsystem Service (LSASS) process. It monitors for events where processes interact with LSASS or execute commands containing 'lsass.exe', 'MiniDump', or 'comsvcs.dll', while excluding known administrative and benign processes like Task Manager, Procdump, and Windows Error Reporting.
Detects potential memory scraping or credential dumping attempts targeting the Google Chrome process (chrome.exe). The rule monitors for command-line arguments involving known dump utilities ('MiniDump', 'procdump', 'rundll32') or the use of 'comsvcs.dll', which is commonly used to dump process memory, specifically when targeted against a browser process.
This rule detects hosts exhibiting behavior consistent with an active ransomware or destructive attack in progress, by correlating five distinct attack-chain stages within a rolling 24-hour window: environment/AD enumeration, network share discovery, lateral movement via RDP, credential dumping, and backup/recovery destruction.
This rule detects potentially unauthorized access or memory dumping attempts against the Local Security Authority Subsystem Service (LSASS) process. It monitors for events where processes interact with LSASS or execute commands containing 'lsass.exe', 'MiniDump', or 'comsvcs.dll', while excluding known administrative and benign processes like Task Manager, Procdump, and Windows Error Reporting.
Detects the creation of an LSASS memory dump file (lsass*.dmp) initiated by Task Manager (taskmgr.exe) within Temp or user directories. This behavior often indicates an adversary or unauthorized user leveraging the Task Manager 'Create dump file' feature to dump process memory for credential harvesting.
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
khunt actor did this after confirming SYSTEM access via KhuntCmd. This one's noisier - backup software and some AV tools do reg save legitimately, so tighten it to non-backup accounts / unmanaged paths if you get FPs.
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
Detects potential memory scraping or credential dumping attempts targeting the Google Chrome process (chrome.exe). The rule monitors for command-line arguments involving known dump utilities ('MiniDump', 'procdump', 'rundll32') or the use of 'comsvcs.dll', which is commonly used to dump process memory, specifically when targeted against a browser process.
khunt actor did this after confirming SYSTEM access via KhuntCmd. This one's noisier - backup software and some AV tools do reg save legitimately, so tighten it to non-backup accounts / unmanaged paths if you get FPs.
Page 13 of 38