Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
Detects Active Directory replication requests (DsGetNcChanges) performed by accounts not identified as Domain Controllers. This behavior is indicative of a DCSync attack, where an adversary uses the directory replication API to extract credentials from Active Directory, potentially leveraging exploited computer accounts.
Detects execution or file drop of the GHOSTBLADE keychain-dumping module (keychain_copier.js) or its parent implant (ghostblade.js) on a device following DarkSword iOS exploit-chain compromise.
Detects the use of the native Windows registry utility 'reg.exe' to save or export the Security Account Manager (SAM) or SYSTEM registry hives to disk. This technique is a common precursor to credential theft, where attackers dump the SAM database to perform offline password cracking. This pattern has been observed in various adversary operations, including ransomware campaigns, to facilitate privilege escalation and lateral movement.
Detects process creation events where a process reported as TiWorker.exe (a trusted Windows servicing process) carries a command line containing Invoke-Mimikatz or Mimikatz command modules, indicating the process identity has been spoofed via a Silo-Binding bind-link mapping TiWorker.exe to PowerShell to evade AV/EDR script-blocking controls.
Detects the use of rundll32.exe to invoke the MiniDump export function within comsvcs.dll against the lsass.exe process. This technique is commonly used by attackers to dump credential material from memory for offline analysis and credential harvesting.
Detects credential dumping activity targeting the Local Security Authority Subsystem Service (LSASS) process using mimikatz.exe. This rule monitors for the execution of mimikatz.exe, direct process access (OpenProcess/ProcessAccessedLsass) to lsass.exe by mimikatz, and the spawning of lsass.exe by the mimikatz process, as observed in post-exploitation scenarios following initial backdoor access.
Detects the execution of the Windows error reporting tool 'createdump.exe' with command-line arguments referencing 'lsass.exe' or the '--full' flag, which is commonly used by adversaries to perform credential dumping from the Local Security Authority Subsystem Service (LSASS) process memory.
Detects suspicious execution of tools or command lines associated with DPAPI domain backup key extraction, including mimikatz, SharpDPAPI, lsadump::backupkeys, and related backupkey commands. This behavior may indicate an attempt to obtain the domain DPAPI backup key from a Domain Controller, enabling decryption of DPAPI-protected secrets across the domain.
Detects NirSoft-based credential harvesting toolkit binaries staged in user profile path csidl_profile\music\mimik\pass\, used to extract browser, VNC, email, Wi-Fi, and Credential Manager secrets
Detects execution of QuarksDumpLocalHash, a tool used to extract local account password hashes directly from the SAM registry hive. This activity is indicative of credential dumping for offline password cracking.
Detects the use of the native Windows 'reg.exe' utility to save or export sensitive registry hives (SAM, SECURITY, or SYSTEM). This activity is a classic technique used by adversaries to perform offline credential dumping.
This query detects the specific credential access pattern used by Storm-1175 (Medusa ransomware operators).
The threat actor first modifies the registry to re-enable WDigest plaintext credential caching, then performs LSASS memory dumping (via Task Manager, Procdump, Mimikatz, NanoDump, or rundll32 comsvcs.dll techniques).
By correlating the registry change with subsequent suspicious LSASS access activity within an 8-hour window, the hunt maintains high fidelity even if the actor switches between different dumping tools.
The threat actor first modifies the registry to re-enable WDigest plaintext credential caching, then performs LSASS memory dumping (via Task Manager, Procdump, Mimikatz, NanoDump, or rundll32 comsvcs.dll techniques).
By correlating the registry change with subsequent suspicious LSASS access activity within an 8-hour window, the hunt maintains high fidelity even if the actor switches between different dumping tools.
Detects the execution of Mimikatz or the use of specific command-line arguments (e.g., sekurlsa::logonpasswords) known for extracting sensitive credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule monitors both process creation command lines and raw process memory read operations targeted at lsass.exe.
Detects execution of the Mimikatz tool where the 'sekurlsa' module is specified in the command line. This module is commonly used to extract sensitive credential material, such as cleartext passwords and Kerberos tickets, from the LSASS process memory.
This rule monitors for processes attempting to access the memory of the Local Security Authority Subsystem Service (LSASS) with permissions (PROCESS_VM_READ and PROCESS_QUERY_INFORMATION) typically required for credential dumping. It filters out processes that have historically performed this action in the last 30 days to reduce noise and highlight potentially malicious or anomalous activity.
Detects the execution of the Mimikatz credential dumping tool, either as the initiating process or the action process, indicating potential credential theft attempts.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
Detects the use of the 'reg.exe' utility to export or save sensitive Windows Registry hives (SAM, SECURITY, SYSTEM) within a short timeframe on a single host. This pattern of credential dumping from the Registry is characteristic of INCRansom activity and other credential harvesting techniques.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
This rule detects the execution of the Mimikatz credential dumping tool by monitoring for specific process names or command-line arguments, including the use of 'sekurlsa' modules to harvest credentials from memory. Mimikatz is widely used by adversaries to perform credential theft, including dumping passwords, hashes, and Kerberos tickets from memory.
Page 14 of 38