Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects the use of the built-in Windows utility esentutl.exe to copy sensitive registry hives (SAM, SECURITY, or SYSTEM). This is a known technique used by adversaries to perform offline credential dumping by accessing the registry hive files.
Detects the execution of SharpDPAPI with command-line arguments designed to perform machine-scoped DPAPI masterkey and certificate recovery. This behavior is often associated with credential theft, particularly the extraction of sensitive secrets like ADFS token-signing keys or machine credentials stored in the DPAPI system.
Detects the use of the built-in Windows utility esentutl.exe to copy sensitive registry hives (SAM, SECURITY, or SYSTEM). This is a known technique used by adversaries to perform offline credential dumping by accessing the registry hive files.
Detects the execution of known Mimikatz credential dumping commands, specifically 'lsadump::dcsync' used for Active Directory credential extraction, and 'sekurlsa' used for extracting credentials from the LSASS process memory.
This rule detects processes that load Pluggable Authentication Modules (PAM) libraries (libpam) and subsequently initiate network connections within a 30-minute window. This behavior is often associated with credential dumping tools or malicious implants attempting to exfiltrate cached credentials or session information from memory on Linux and macOS systems.
Detects the execution of Mimikatz with command line arguments indicative of credential dumping, specifically DCSync attacks or dumping LSASS memory for passwords. The rule filters out processes signed by Microsoft to reduce noise.
This rule detects potentially malicious access to the Local Security Authority Subsystem Service (LSASS) process (lsass.exe). It correlates events where a process requests sensitive access rights (0x1010 or PROCESS_VM_READ) to LSASS with other activities indicating the presence of Mimikatz or related credential dumping tools (e.g., presence of 'mimikatz' or 'sekurlsa' in process names or command lines).
This rule monitors for a suspicious execution pattern where a browser (Chrome or Edge) is launched with specific command-line flags ('--no-first-run', '--disable-gpu', 'about:blank') by a non-standard parent process, followed shortly by the loading of the 'elevation_service.exe' from 'services.exe' and the loading of 'DPAPI.dll' by the browser process. This sequence is often associated with automated browser credential dumping activities, where attackers attempt to bypass UI requirements or programmatically extract secrets from the browser's credential storage.
Detects various indicators of credential dumping associated with Mimikatz and manual extraction of the Active Directory database (NTDS.dit). This includes execution of Mimikatz, use of specific modules like lsadump::dcsync and sekurlsa::logonpasswords, direct access to the LSASS process, and usage of ntdsutil or vssadmin to create shadow copies for NTDS.dit file access.
This rule detects command-line arguments and file names associated with the execution of Mimikatz or derived tools (such as SafetyKatz). It monitors for specific modules and flags, including credential harvesting (sekurlsa, lsadump, vault), DPAPI operations, and Kerberos manipulation, which are characteristic of adversary credential theft and privilege escalation activities.
This rule detects unauthorized processes attempting to open a handle to the Local Security Authority Subsystem Service (lsass.exe) with PROCESS_VM_READ access rights. Such access is often associated with credential dumping techniques, particularly those utilizing direct syscalls to evade EDR and kernel-level monitoring by bypassing standard Windows API-based detection mechanisms.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
Detects the execution of Mimikatz specifically utilizing the lsadump::dcsync command or the internal DRSGetNCChanges function call. These behaviors are indicative of an adversary performing directory replication abuse against a Domain Controller to extract sensitive Active Directory credentials, including password hashes.
Detects anomalous network traffic patterns characteristic of the Mimikatz 'lsadump' module performing a DCSync attack. The rule monitors for DRSUAPI (Directory Replication Service Remote Protocol) RPC requests, specifically the DsGetNCChanges operation, which is abused to synchronize Active Directory data including sensitive password hashes.
Detects the use of the native Windows 'reg.exe' utility to export sensitive registry hives (SAM, SECURITY, SYSTEM) commonly targeted by adversaries for offline credential extraction.
Detects the use of reg.exe to save the HKLM\SAM registry hive to a file path outside of standard system directories. This behavior is indicative of credential dumping attempts, where adversaries attempt to bypass endpoint security behavioral detection rules that monitor for SAM file access in common locations by using alternative, potentially allowlisted paths.
Detects potential credential dumping activity targeting sensitive files like NTDS.dit, SAM, and SYSTEM hives. This rule monitors for three primary indicators: unauthorized invocation of vssuirun.exe (often used for Volume Shadow Copy manipulation), exploitation of print command utilities to access sensitive system files, and the staging of critical credential files into temporary directory paths.
Detects the execution of known Impacket framework tools (such as secretsdump, wmiexec, smbexec, atexec, GetUserSPNs, or ntlmrelayx) which are commonly used for credential dumping, remote service execution, and lateral movement.
Detects attempts to access or copy the Active Directory domain database (NTDS.dit), which contains sensitive credential material. The rule monitors for the use of built-in administrative tools such as esentutl, ntdsutil, vssadmin, and wbadmin, as well as file copy utilities (robocopy, xcopy) when specifically targeting the NTDS directory or volume shadow copies containing the database file.
This rule detects common methods used by adversaries to perform credential dumping by accessing the memory of the Local Security Authority Subsystem Service (LSASS). It specifically flags the use of Procdump to create a memory dump of LSASS, the use of the native Windows utility comsvcs.dll via rundll32 to dump process memory, and the creation of LSASS dump files via the Windows Task Manager.
This rule detects modifications to registry keys related to the Local Security Authority (LSA) or Security Account Manager (SAM). Such modifications, indicated by Event ID 4657, can be a sign of privilege escalation attempts, credential dumping, or other malicious activities aimed at compromising system security.
Page 15 of 38