Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects Active Directory object access events (Event ID 4662) associated with domain controller replication rights (Replication-Get-Changes or Replication-Get-Changes-All). This behavior is often associated with credential dumping techniques like DCSync, where an attacker impersonates a domain controller to request replication of sensitive data, such as password hashes, from another domain controller.
Detects Active Directory object access events (Event ID 4662) associated with domain controller replication rights (Replication-Get-Changes or Replication-Get-Changes-All). This behavior is often associated with credential dumping techniques like DCSync, where an attacker impersonates a domain controller to request replication of sensitive data, such as password hashes, from another domain controller.
Detects suspicious activities within a Veeam backup environment, including unauthorized process spawning by Veeam services, LSASS memory access, destruction of backup catalogs or restore points via PowerShell, and unauthorized access to Veeam database files by non-Veeam processes.
Detects attempts to open the Local Security Authority Subsystem Service (LSASS) process with read permissions (specifically, PROCESS_VM_READ access) by non-system processes. This activity is often associated with credential dumping techniques.
Detects attempts to open the Local Security Authority Subsystem Service (LSASS) process with read permissions (specifically, PROCESS_VM_READ access) by non-system processes. This activity is often associated with credential dumping techniques.
Detects attempts to dump credentials using 'reg save HKLM\SAM' command or the 'impacket-secretsdump' tool. These methods are commonly used by adversaries to extract password hashes from the Security Account Manager (SAM) database or other credential stores for offline cracking or reuse.
Detects attempts to extract the Active Directory database (NTDS.dit) by monitoring for the execution of administrative tools (vssadmin, diskshadow, ntdsutil, esentutl) with command-line arguments indicative of file copying, shadow copy creation, or database manipulation.
Detects techniques used to extract the Active Directory database (NTDS.dit) for credential dumping. This includes the use of native Windows utilities like ntdsutil.exe, vssadmin.exe, and diskshadow.exe to create volume shadow copies, as well as the identification of ntds.dit files being created or accessed in non-standard locations.
Detects common credential dumping techniques targeting the LSASS process or NTDS.dit database, including the use of known dump utilities such as Procdump, Rundll32 with comsvcs.dll, and Ntdsutil, as well as unauthorized process access to LSASS.
This rule detects when the Remcos RAT loader attempts to access browser cache folders (Chrome, Firefox, Opera). This activity is indicative of credential dumping, where the malware tries to extract sensitive information like stored passwords or session tokens from web browsers.
Detects the creation or referencing of 'lopa.txt' which the Seedworm threat group uses to save stolen passwords. This rule identifies processes that interact with 'lopa.txt' either through their command line arguments or by directly accessing a file with that name.
Detects potential credential dumping activity where ManageEngine ADSelfService processes initiate other processes commonly associated with credential dumping, such as taskmgr.exe, lsass.exe, winlogon.exe, or wlrmdr.exe. This behavior could indicate an adversary attempting to extract credentials.
Detects LSASS credential dumping using comsvcs.dll via rundll32, specifically looking for the ordinal 24 or the string "MiniDump" in the command line. This technique is commonly used by attackers for credential harvesting, especially after bypassing EDR solutions.
Detects common credential dumping techniques targeting the LSASS process memory, including the execution of Mimikatz, use of 'sekurlsa::logonpasswords', and memory dumps using comsvcs.dll or procdump.
Detects the threat actor utilizing the TiFlux backdoor access to run credential dumping tools (Mimikatz, Procdump) against LSASS.
Detects the use of 'credwiz.exe' with the 'B' argument, which indicates a credentials backup operation. This activity could be indicative of an adversary attempting to dump credentials from a compromised system.
Detects cross-process access to the Local Security Authority Subsystem Service (LSASS) memory by processes that are not standard Microsoft-signed system components. This behavior is often indicative of credential dumping activity using tools like Mimikatz or other custom malicious utilities attempting to read sensitive memory contents.
Detects attempts to dump SAM database for local credential extraction
Detects the 'strings' command being run directly against /proc/*/mem to extract human-readable strings (such as tokens or passwords) from raw memory. This activity is often associated with credential dumping techniques on Linux systems.
Detects reg.exe saving the SYSTEM hive to \Windows\Temp\. This activity is often associated with credential dumping techniques where adversaries extract the SAM database for offline cracking.
Identifies Task Manager spawning dumps of the LSASS process space, which are subsequently staged in temporary locations. This activity is associated with the UNC6692 threat group.
Page 25 of 38