Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
This rule detects suspicious SMB traffic targeting raw disk volumes (e.g., PhysicalDrive, C:) or sensitive Windows files such as NTDS.dit and SYSTEM hive files. This behavior is indicative of credential dumping attempts, often performed using tools like secretsdump.py or Invoke-NinjaCopy, which bypass standard file system access controls to exfiltrate critical system credentials.
This rule detects attempts to acquire Windows credentials by accessing critical registry hives (SAM, SYSTEM, SECURITY) or their shadow copies. It looks for the use of 'reg save' to export hives, as well as direct file access to these hives or their shadow copy variations by non-standard system processes.
Detects unsigned or non-Microsoft processes attempting to access sensitive system process memory (lsass.exe, winlogon.exe, services.exe) or processes attempting to enable SeDebugPrivilege, which are common indicators of credential dumping or process injection attempts.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
The rule detects potential credential dumping activities by monitoring for the execution of Mimikatz or the use of its specific command-line arguments (e.g., sekurlsa::logonpasswords, /ntlm:). It also monitors for suspicious, unauthorized processes attempting to open a handle to the LSASS process to access its memory, a common technique for dumping credentials.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
Detects the creation of files with non-standard extensions (.elf, .raw, .file, .sense) in the 'C:\Users\Public\' directory. This activity is indicative of the ShadowDumper tool, which generates LSASS memory dumps and writes them to publicly accessible paths using atypical file extensions to evade signature-based detection.
Detects unauthorized or suspicious processes attempting to open a handle to the Local Security Authority Subsystem Service (lsass.exe) with access rights required for memory reading, such as PROCESS_VM_READ or PROCESS_QUERY_INFORMATION. This behavior is a common prerequisite for credential dumping techniques like Minidump or direct memory extraction used by malicious tools.
Detects potential credential harvesting attempts by monitoring for the usage of Windows credential management tools (cmdkey.exe and vaultcmd.exe) and the loading of sensitive DLLs (vaultcli.dll, dpapi.dll) by non-Microsoft signed processes, which is commonly used to access stored credentials in the Windows Vault or by DPAPI-protected stores.
Detects attempts to modify the WDigest UseLogonCredential registry value, which can be used to force Windows to store plaintext credentials in LSASS memory. Adversaries use this technique to facilitate credential dumping.
Detects modifications to the 'UseLogonCredential' registry value under the WDigest security provider. Enabling this setting allows Windows to store plaintext credentials in memory (LSASS), which facilitates credential theft and credential dumping attacks.
Detects Mimikatz-based credential dumping against the Local Security Authority Subsystem Service (LSASS) process. The rule identifies this activity by monitoring for renamed or known Mimikatz binary names, execution of specific credential-harvesting command-line arguments (such as sekurlsa::logonpasswords or privilege::debug), output redirection to credential-related files, or the loading of the Mimikatz kernel driver (mimidrv.sys).
Detects the use of legitimate Windows system utilities (ntdsutil.exe, vssadmin.exe, esentutl.exe) to interact with the Active Directory database file (ntds.dit). This behavior is commonly associated with offline credential harvesting, where an attacker attempts to create a copy of the database to extract hashes offline.
This rule detects various methods used to copy or access the Active Directory database (NTDS.dit), a common technique used by attackers to dump domain credentials. The rule monitors for the use of ntdsutil with 'ifm' (install from media) arguments, vssadmin to create volume shadow copies of the NTDS file, esentutl directly interacting with the NTDS database path, and common file copy utilities attempting to copy the NTDS.dit file.
Detects the use of native Windows utilities (vssadmin, ntdsutil, diskshadow, esentutl) or command-line execution (cmd, powershell) to access, copy, or create shadow copies of the Active Directory database file (NTDS.dit), which is a common indicator of credential dumping.
Detects various techniques used to extract the Active Directory NTDS.dit database on Windows. The rule monitors for the misuse of administrative tools including ntdsutil.exe (for IFM or instance activation), vssadmin.exe (to create volume shadow copies as a prerequisite), and esentutl.exe (for direct ESE database operations). The detection focuses on suspicious command-line patterns indicative of credential dumping attempts.
Detects the use of rundll32.exe to execute the MiniDump function of comsvcs.dll, a known technique for dumping the memory of the Local Security Authority Subsystem Service (LSASS) process to gain access to stored credentials.
Detects unauthorized credential dumping attempts against the Local Security Authority Subsystem Service (LSASS) process. The rule identifies suspicious use of system utilities like 'comsvcs.dll' via rundll32, cross-process handle access by unauthorized processes, and the execution of offensive security tools such as lsassy and crackmapexec.
Detects attempts to perform credential dumping from the LSASS process memory using the built-in Windows binary rundll32.exe to execute comsvcs.dll. The rule monitors for specific command-line arguments and common output file paths associated with manual dumping or automated tools like lsassy.
Detects the use of rundll32.exe to invoke the MiniDump function of comsvcs.dll to create a memory dump of the Local Security Authority Subsystem Service (LSASS). This technique is a common method for dumping LSASS memory to harvest credentials, often used by tools like lsassy and various post-exploitation frameworks. The rule monitors for the specific command line patterns used in this attack, including referencing comsvcs.dll and the 'full' dump argument, initiated by suspicious parent processes frequently seen in lateral movement scenarios.
Page 17 of 38