Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects the execution of tools writing Active Directory database components (ntds.dit, SAM, SYSTEM, SECURITY) directly into user download directories. This activity is indicative of credential harvesting, specifically targeting Active Directory database files.
Identifies explicit attempts to parse or dump the Active Directory database using ntdsutil.exe IFM creation parameters.
Detects instances where an unsigned or non-trusted process attempts to access the memory of the Local Security Authority Subsystem Service (LSASS). Accessing LSASS memory is a common technique used by threat actors to harvest credentials for lateral movement and privilege escalation.
Detects potential credential dumping activity where ManageEngine ADSelfService processes initiate other processes commonly associated with credential dumping, such as taskmgr.exe, lsass.exe, winlogon.exe, or wlrmdr.exe. This behavior could indicate an adversary attempting to extract credentials.
Detects the execution of 'memdump', a utility that captures physical or process memory, indicating potential memory scraping activity.
This rule detects the creation of a new GitHub repository from a compromised endpoint, specifically looking for indicators of stolen credential exfiltration. The rule identifies GitHub application events where a repository is created and the raw event data contains keywords associated with credential dumping or specific campaign names like "Miasma" or "Spreading Blight". Automated exfiltration to GitHub is often fast and difficult to remediate, making prompt detection crucial. If triggered, it's recommended to revoke tokens used to create the repository and investigate the endpoint for compromise.
This rule detects attempts to access or dump the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which can contain sensitive credential information. It specifically looks for Security Event ID 4656 (handle to an object was requested) where the target object is 'lsass.exe', 'lsass.bin', or 'ntds.dit', with specific access masks ('0x1fffff' or '0x1410'), and excludes common system accounts. A high count of such access attempts within an hour from a non-system user triggers the alert.
Detects unauthorized access to macOS Keychain for credential extraction
Detects reg.exe saving the SECURITY hive to \Windows\Temp\.
Detects Python scripts utilizing ctypes, ptrace, or process_vm_readv to perform advanced, programmatic memory scraping without relying on shell utilities. This activity can be indicative of credential dumping or other forms of sensitive data exfiltration from process memory.
Detects access to LSA Secrets stored in registry for service account credentials
Detects the execution of Procdump targeting the Local Security Authority Subsystem Service (LSASS) process. This activity is commonly associated with credential dumping, where an attacker attempts to extract sensitive authentication material (like passwords or hashes) from memory.
This rule detects attempts to access or dump the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which can contain sensitive credential information. It specifically looks for Security Event ID 4656 (handle to an object was requested) where the target object is 'lsass.exe', 'lsass.bin', or 'ntds.dit', with specific access masks ('0x1fffff' or '0x1410'), and excludes common system accounts. A high count of such access attempts within an hour from a non-system user triggers the alert.
Detects reg.exe saving the SAM hive directly to \Windows\Temp\, indicative of offline credential cracking.
Detects non-system processes attempting to open a handle to the LSASS process with read or virtual memory read access. This activity is indicative of credential dumping, a technique often used by adversaries like MuddyWater after gaining initial access, for example, through social engineering.
Detects DCSync replication attack for credential dumping from AD
Detects the execution of known credential extraction tools such as Mimikatz, LaZagne, Hashcat, or John the Ripper, indicated by specific keywords in the command line arguments. This rule monitors for process creation events (EventID 4688) where these tools are used in conjunction with keywords related to passwords, hashes, or credentials.
Detects the execution of known credential extraction tools such as Mimikatz, LaZagne, Hashcat, or John the Ripper, indicated by specific keywords in the command line arguments. This rule monitors for process creation events (EventID 4688) where these tools are used in conjunction with keywords related to passwords, hashes, or credentials.
Detects Python scripts accessing the /proc/*/mem file of the Runner.Worker process. This activity is indicative of memory scraping, potentially to extract sensitive information like masked GitHub Actions secrets, as observed with malware like Miasma.
Detects memory dumps piped to 'tr -d' to strip null bytes. This specific shell pipeline is a known Miasma technique used to parse raw process memory for readable secrets.
Detects ptrace access to securityd process memory for credential extraction
Page 26 of 38