Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects Zerologon exploitation attempts against domain controllers by monitoring for anomalous machine account password resets, execution of known exploitation tooling (e.g., zerologon_tester, secretsdump), and patterns of rapid Netlogon zero-credential authentication failures.
Detects the execution of Rubeus or Mimikatz with command-line arguments indicative of Kerberos attacks such as Pass the Ticket (PtT) or Golden Ticket generation. This rule specifically looks for keywords like 'rubeus ptt', 'kerberos::ptt', 'kerberos::golden', and 'mimikatz kerberos' in process command lines.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects unauthorized attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process. The rule monitors for cross-process memory access, the use of legitimate Windows tools like rundll32.exe (loading comsvcs.dll) and procdump.exe for dumping LSASS, and detection of Cobalt Strike-specific command-line patterns related to credential theft.
This rule monitors for the execution of native Windows utilities (vssadmin.exe, ntdsutil.exe, diskshadow.exe, esentutl.exe) commonly abused by attackers to create volume shadow copies or access the NTDS.dit file for credential dumping or system recovery inhibition.
Detects attempts to dump the memory of the Local Security Authority Subsystem Service (LSASS) process using the built-in Windows comsvcs.dll via rundll32.exe or tasklist commands, a common technique used for credential harvesting.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
Detects the unauthorized use of 'wbadmin.exe' to initiate a backup of Active Directory components (like 'ntds.dit' or the SYSTEM registry hive) when executed from common command-line interpreters (cmd.exe, powershell.exe). The rule correlates this backup activity with subsequent direct file access to sensitive AD database or registry files by processes other than standard system services (e.g., ntds.exe, lsass.exe), often indicative of credential dumping or exfiltration.
Detects a suspicious sequence of adversary behaviors typically associated with pre-ransomware activity. The rule identifies high-volume SMB scanning (more than 20 unique IPs in 5 minutes) correlated with network share discovery (using tools like netscan.exe or PowerShell scripts such as Invoke-ShareFinder), and optionally links these actions to credential dumping events on the same host (LSASS dumping via comsvcs.dll or NTDS.dit exfiltration via wbadmin) within a 48-hour window.
Detects a sequence of events indicative of LSASS memory dumping followed by lateral movement via SMB administrative shares. The rule monitors for suspicious OpenProcess calls targeting lsass.exe, the subsequent creation of dump files in temporary directories, and concurrent access to admin shares (ADMIN$ or C$) from the same host, which is a common pattern for credential harvesting and lateral movement tools like 'lsassy'.
Detects the execution of known Impacket framework scripts such as psexec.py, wmiexec.py, and secretsdump.py, or command lines containing common indicators associated with these tools. The rule monitors process start events and filters for indicators of lateral movement and credential harvesting including administrative share access and lsass or ntds.dit interaction.
Detects unauthorized cross-process memory access attempts targeting the Local Security Authority Subsystem Service (lsass.exe). Such attempts are commonly associated with credential dumping techniques to extract credentials from memory.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects unauthorized or non-standard attempts to replicate directory data from a Domain Controller, specifically looking for Directory Replication Service (DRS) GetChanges and GetChangesAll access requests. This behavior is indicative of a DCSync attack, often used by adversaries to dump credentials from the NTDS.dit database.
This rule detects common methods used by adversaries to perform credential dumping by accessing the memory of the Local Security Authority Subsystem Service (LSASS). It specifically flags the use of Procdump to create a memory dump of LSASS, the use of the native Windows utility comsvcs.dll via rundll32 to dump process memory, and the creation of LSASS dump files via the Windows Task Manager.
Detects LSASS process memory access for credential dumping
This rule detects the execution of Mimikatz via process name matching or the presence of known credential dumping command-line arguments (e.g., 'sekurlsa::logonpasswords' or 'privilege::debug'). These indicators are commonly used by adversaries to extract sensitive information like plaintext passwords or hashes from the LSASS memory process.
Detects unauthorized attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process to harvest credentials. This rule covers known credential dumping tools like Pillager and Procdump, the abuse of built-in Windows diagnostic tools like comsvcs.dll, and Mimikatz-style credential harvesting commands (e.g., sekurlsa). It also includes a generic detection for suspicious processes attempting to open a handle to lsass.exe.
Detects sensitive Active Directory replication operations (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All) initiated by accounts other than standard domain controllers. This behavior is a common indicator of DCSync attacks, where an adversary mimics a domain controller to request sensitive Active Directory data, such as password hashes, from a legitimate domain controller.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) related to Directory Replication (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All GUIDs) originating from non-domain controller accounts. This identifies unauthorized attempts to replicate Active Directory password data.
Detects activity associated with the unauthorized copying of sensitive system files (e.g., NTDS.dit, SAM, SYSTEM) using Volume Shadow Copy, or the use of Rclone for potential data exfiltration via SFTP, copy, or sync operations.
Page 19 of 38