Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects unauthorized cross-process handle requests to sensitive Windows authentication processes (lsass.exe and winlogon.exe) by non-system and non-whitelisted processes. This behavior is commonly associated with credential dumping techniques and malicious process injection aimed at stealing sensitive authentication data.
Detects unauthorized cross-process handle requests to sensitive Windows authentication processes (lsass.exe and winlogon.exe) by non-system and non-whitelisted processes. This behavior is commonly associated with credential dumping techniques and malicious process injection aimed at stealing sensitive authentication data.
This rule monitors process execution events for the usage of common memory dumping utility names (e.g., procdump, memdump, coredump, crashdump) via command-line interfaces such as cmd.exe or powershell.exe. This activity is frequently associated with attackers attempting to dump sensitive process memory, such as LSASS, to extract credentials or other secrets from memory.
Detects the creation of 'lsass.dmp' files outside of standard Windows Error Reporting (WER) or CrashDumps paths. This activity can indicate an attempt to dump LSASS memory for credential access.
Detects access to NTDS.dit for Active Directory credential dumping
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
Detects the use of rundll32.exe to execute the MiniDump function of comsvcs.dll to create a memory dump of the Local Security Authority Subsystem Service (LSASS). This technique is commonly used by adversaries to extract credential materials from LSASS memory.
Detects the use of rundll32.exe to execute the MiniDump function of comsvcs.dll to create a memory dump of the Local Security Authority Subsystem Service (LSASS). This technique is commonly used by adversaries to extract credential materials from LSASS memory.
This rule detects attempts to acquire Windows credentials by accessing critical registry hives (SAM, SYSTEM, SECURITY) or their shadow copies. It looks for the use of 'reg save' to export hives, as well as direct file access to these hives or their shadow copy variations by non-standard system processes.
Detects unsigned or non-Microsoft processes attempting to access sensitive system process memory (lsass.exe, winlogon.exe, services.exe) or processes attempting to enable SeDebugPrivilege, which are common indicators of credential dumping or process injection attempts.
Detects instances where an unsigned or non-trusted process attempts to access the memory of the Local Security Authority Subsystem Service (LSASS). Accessing LSASS memory is a common technique used by threat actors to harvest credentials for lateral movement and privilege escalation.
This rule detects activities associated with credential dumping, specifically targeting techniques that abuse the Directory Replication Service (DRS) protocol, such as DCSync or the use of tools like secretsdump. It monitors both process execution command lines and network traffic for keywords indicative of these credential extraction behaviors, which are commonly used by attackers to obtain domain credentials.
Detects the execution of processes with command-line arguments characteristic of the Mimikatz tool, specifically the 'sekurlsa', 'lsadump', and 'privilege::debug' modules used for credential dumping and process debugging.
This rule detects cross-process memory access attempts against the Local Security Authority Subsystem Service (LSASS). Accessing LSASS memory is a common technique used by attackers to dump credentials (e.g., cleartext passwords, NTLM hashes, Kerberos tickets) for lateral movement and privilege escalation. The rule filters out known legitimate processes and system-signed components to reduce false positives.
Detects the use of Mimikatz to perform a DCSync attack, which allows an adversary to simulate the replication process from a domain controller to extract sensitive password hashes from Active Directory.
Detects unauthorized or suspicious processes attempting to access the memory of the Local Security Authority Subsystem Service (lsass.exe). This activity often indicates attempts to dump process memory to harvest sensitive credentials, a common technique used by attackers to facilitate lateral movement.
Detects the use of rundll32.exe to execute comsvcs.dll, a common technique used to create a memory dump of the LSASS process to extract credentials.
Detects the use of the native Windows utility ntdsutil.exe with arguments 'ac i ntds' or 'ifm', which are commonly used to perform an 'Install from Media' (IFM) operation. This technique is frequently abused by adversaries to create a snapshot of the Active Directory database (ntds.dit) and the SYSTEM registry hive, facilitating offline credential dumping.
Detects cross-process memory access attempts targeting the Local Security Authority Subsystem Service (lsass.exe). The rule filters out known Microsoft-signed system processes and common Windows binaries to identify potential unauthorized credential dumping activity.
Detects the use of rundll32.exe to execute comsvcs.dll, a common technique used to create a memory dump of the LSASS process to extract credentials.
Detects the use of the native Windows utility ntdsutil.exe with arguments 'ac i ntds' or 'ifm', which are commonly used to perform an 'Install from Media' (IFM) operation. This technique is frequently abused by adversaries to create a snapshot of the Active Directory database (ntds.dit) and the SYSTEM registry hive, facilitating offline credential dumping.
Page 24 of 38