Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects the execution of built-in Windows utilities such as ntdsutil.exe, vssadmin.exe, and diskshadow.exe, often used by attackers to dump the Active Directory database (NTDS.dit) or manipulate volume shadow copies for credential theft or data staging/destruction purposes.
Detects high-privilege access to the LSASS process (lsass.exe), commonly associated with credential dumping techniques such as LSASS memory reading. The rule monitors for specific process access masks (0x1010 and 0x1fffff) originating from non-system, non-security tool processes.
Time-series correlation detecting Pass-The-Hash authentication behavior immediately following the extraction of LSASS memory.
Detects Active Directory dataset extraction techniques used by MexicanMafia (Operation Escaneo), including ntds.dit access, secretsdump execution, VSS shadow copy abuse, and BloodHound-style AD enumeration for long-term persistence and reconnaissance against critical infrastructure.
Detects procdump execution targeting lsass.exe A variation of https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19
Detects Active Directory dataset extraction techniques used by MexicanMafia (Operation Escaneo), including ntds.dit access, secretsdump execution, VSS shadow copy abuse, and BloodHound-style AD enumeration for long-term persistence and reconnaissance against critical infrastructure.
This rule detects when the Remcos RAT loader attempts to access browser cache folders (Chrome, Firefox, Opera). This activity is indicative of credential dumping, where the malware tries to extract sensitive information like stored passwords or session tokens from web browsers.
Detects attempts by processes identified as Remcos RAT or its loader (GST*.com) to access Local Security Authority (LSA) secrets. This activity is indicative of credential dumping, where an attacker tries to extract sensitive authentication material from the system.
Detects attempts by processes identified as Remcos RAT or its loader (GST*.com) to access Local Security Authority (LSA) secrets. This activity is indicative of credential dumping, where an attacker tries to extract sensitive authentication material from the system.
Detects suspicious activities within a Veeam backup environment, including unauthorized process spawning by Veeam services, LSASS memory access, destruction of backup catalogs or restore points via PowerShell, and unauthorized access to Veeam database files by non-Veeam processes.
Detects instances of wermgr.exe (Windows Error Reporting) interacting with Volume Shadow Copies or using specific Alternate Data Streams (WDFOO). This behavior is often associated with credential dumping tools (e.g., Mimikatz, SharpShadow) attempting to access sensitive files from shadow copies under the context of a non-system user, potentially indicating evasion techniques or credential harvesting.
Detects the SimpleHelp process (identified by JWrapper) attempting to open the LSASS process, which is a common technique for credential dumping. This rule specifically looks for process access events where the target is 'lsass.exe' and the initiating process is associated with SimpleHelp.
Detects attempts to access or exfiltrate the Windows Security Account Manager (SAM) or SYSTEM registry hives, which are primary targets for extracting credential hashes. This rule identifies common attack vectors including native Windows registry utilities (reg.exe), PowerShell-based volume shadow copy techniques (Invoke-NinjaCopy), and known credential dumping tools like secretsdump (from the Impacket suite) executed via command line or interpreted through Python.
Detects modifications to the WDigest UseLogonCredential registry value, which is a known technique to force Windows to store plaintext credentials in memory. This is often performed by adversaries using tools like Mimikatz to facilitate credential dumping from the LSASS process.
This rule detects attempts by non-browser processes to access sensitive files that commonly contain credentials, such as browser login data (Chrome, Firefox) or the Windows Security Account Manager (SAM) database. This activity could indicate credential dumping or information theft.
Detects execution of Mimikatz or the use of specific Mimikatz command-line arguments (e.g., 'sekurlsa::logonpasswords', 'privilege::debug') indicative of credential dumping, a common technique for harvesting plaintext credentials or hashes from LSASS memory.
Detects suspicious access to the Local Security Authority Subsystem Service (lsass.exe) process memory, indicated by Sysmon Event ID 10 with an 'UNKNOWN' call trace. This pattern is characteristic of direct syscall usage or memory injection techniques used to bypass standard Windows API hooking and security monitoring, common in credential dumping attempts.
Detects various methods and tools commonly used by adversaries for credential dumping, including process memory dumping of lsass.exe via procdump or comsvcs.dll, and the execution of credential dumping tools like Impacket's secretsdump, ntlmrelayx, or Mimikatz.
Detects attempts by non-system, potentially unauthorized processes to access the LSASS process memory. This behavior is commonly associated with credential dumping techniques used by adversaries to harvest sensitive authentication material from the Local Security Authority Subsystem Service.
Detects attempts by non-system, potentially unauthorized processes to access the LSASS process memory. This behavior is commonly associated with credential dumping techniques used by adversaries to harvest sensitive authentication material from the Local Security Authority Subsystem Service.
This rule monitors process execution events for the usage of common memory dumping utility names (e.g., procdump, memdump, coredump, crashdump) via command-line interfaces such as cmd.exe or powershell.exe. This activity is frequently associated with attackers attempting to dump sensitive process memory, such as LSASS, to extract credentials or other secrets from memory.
Page 23 of 38