Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects the execution of processes with command-line arguments characteristic of the Mimikatz tool, specifically the 'sekurlsa', 'lsadump', and 'privilege::debug' modules used for credential dumping and process debugging.
Detects unauthorized or suspicious processes attempting to access the memory of the Local Security Authority Subsystem Service (lsass.exe). This activity often indicates attempts to dump process memory to harvest sensitive credentials, a common technique used by attackers to facilitate lateral movement.
Detects the use of Mimikatz to perform a DCSync attack, which allows an adversary to simulate the replication process from a domain controller to extract sensitive password hashes from Active Directory.
Detects cross-process memory access attempts targeting the Local Security Authority Subsystem Service (lsass.exe). The rule filters out known Microsoft-signed system processes and common Windows binaries to identify potential unauthorized credential dumping activity.
Detects attempts to access or copy the Active Directory domain database (NTDS.dit) by monitoring for direct file access to the file or the execution of ntdsutil.exe with arguments intended to create an Install From Media (IFM) set, which is a known technique for exfiltrating the NTDS.dit file for offline password cracking.
Detects attempts to extract the Security Account Manager (SAM) database, either by using the 'reg save' utility to export registry hives containing the SAM or by directly creating/modifying the SAM file on disk outside of known legitimate system processes.
This rule detects potential credential dumping attempts against the Local Security Authority Subsystem Service (LSASS). It monitors two distinct suspicious behaviors: 1) The enablement of 'SeDebugPrivilege' by non-system processes via Windows security event 4703, and 2) Suspicious OpenProcess calls targeting sensitive Windows processes (lsass.exe, csrss.exe, winlogon.exe, services.exe, smss.exe) initiated by non-system accounts with high-level access rights.
This rule detects potential credential dumping attempts against the Local Security Authority Subsystem Service (LSASS). It monitors two distinct suspicious behaviors: 1) The enablement of 'SeDebugPrivilege' by non-system processes via Windows security event 4703, and 2) Suspicious OpenProcess calls targeting sensitive Windows processes (lsass.exe, csrss.exe, winlogon.exe, services.exe, smss.exe) initiated by non-system accounts with high-level access rights.
Detects unauthorized or non-standard attempts to replicate directory data from a Domain Controller, specifically looking for Directory Replication Service (DRS) GetChanges and GetChangesAll access requests. This behavior is indicative of a DCSync attack, often used by adversaries to dump credentials from the NTDS.dit database.
Detects the execution of the Mimikatz tool or the usage of specific command-line arguments associated with common credential dumping and persistence techniques, such as Skeleton Key or LSASS patching.
Detects the execution of the Mimikatz tool or the usage of specific command-line arguments associated with common credential dumping and persistence techniques, such as Skeleton Key or LSASS patching.
Detects the use of the built-in Windows tool 'ntdsutil.exe' to perform an Install from Media (IFM) operation, which creates a copy of the Active Directory database (NTDS.dit). The rule specifically flags when this output is directed to suspicious paths like 'C:\Windows\Temp' or 'C:\Users\Public', which are common locations used by adversaries to stage files for exfiltration.
Detects the use of the built-in Windows tool 'ntdsutil.exe' to perform an Install from Media (IFM) operation, which creates a copy of the Active Directory database (NTDS.dit). The rule specifically flags when this output is directed to suspicious paths like 'C:\Windows\Temp' or 'C:\Users\Public', which are common locations used by adversaries to stage files for exfiltration.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
This rule detects various methods used to extract credentials protected by the Windows Data Protection API (DPAPI). It covers multiple vectors, including Mimikatz DPAPI module usage, unauthorized loading of the dpapi.dll library, suspicious access to browser or WiFi credential stores, and cross-process memory access to the LSASS process to extract DPAPI master keys.
Detects cross-process access to the Local Security Authority Subsystem Service (LSASS) memory by processes that are not standard Microsoft-signed system components. This behavior is often indicative of credential dumping activity using tools like Mimikatz or other custom malicious utilities attempting to read sensitive memory contents.
Detects the execution of Impacket framework scripts (secretsdump, ntlmrelayx, psexec, wmiexec, smbexec) from a portable directory path named 'mini_imp'. This pattern is associated with credential dumping from LSASS and unauthorized lateral movement activities, similar to those observed in Operation Escaneo.
This rule detects attempts to dump LSASS process memory using common tools like procdump, rundll32 with comsvcs.dll, or mimikatz (sekurlsa module), followed by DCOM lateral movement (network connection on port 135) on the same device within a 30-minute window. This sequence of events is indicative of an adversary attempting to steal credentials and then use them for lateral movement within the network.
This rule correlates three distinct events to detect a potential credential theft and lateral movement chain: an LSASS credential dump, followed by an NTLM network logon, and then a DCOM activation of mmc.exe with the '-Embedding' flag on the target system. This sequence of events is indicative of an attacker compromising credentials, using them to move laterally, and then potentially executing further commands or tools via DCOM.
This rule detects common credential dumping techniques targeting the LSASS process memory (using comsvcs.dll, procdump, or procdump64) and extraction of the Active Directory database (NTDS.dit) using ntdsutil, vssadmin, diskshadow, or esentutl. These activities are indicative of credential theft and domain-wide reconnaissance.
Detects techniques used to perform credential dumping from the LSASS process memory, including the use of comsvcs.dll via rundll32, the procdump utility, and unauthorized process handle requests (OpenProcess) targeting lsass.exe.
Page 22 of 38