Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects reading of process memory via /proc filesystem for credential extraction
Detects attempts to dump SAM database for local credential extraction
This rule detects the execution of processes where the command line contains keywords commonly associated with credential dumping activities, specifically targeting NTUser.dat, SAM, or SYSTEM files. These files often contain sensitive credential information that attackers attempt to extract.
This rule detects attempts to dump LSA secrets by accessing the 'SECURITY\Policy\Secrets' registry key remotely over SMB (port 445). This activity is indicative of credential access attempts, specifically targeting cached credentials or other sensitive information stored in the Local Security Authority (LSA). The rule looks for the specific string 'SECURITY\Policy\Secrets' within TCP traffic destined for port 445, suggesting an attempt to read this registry path.
This rule detects modifications to registry keys related to the Local Security Authority (LSA) or Security Account Manager (SAM). Such modifications, indicated by Event ID 4657, can be a sign of privilege escalation attempts, credential dumping, or other malicious activities aimed at compromising system security.
Detects inbound RPC calls to the Windows Remote Registry interface using operation numbers associated with registry save/backup operations, which may indicate credential dumping via remote registry access. This rule specifically looks for RPC UUID '338cd001-2244-31f1-aaaa-900038001003' and operation numbers 20 or 31, which correspond to registry save/backup functions.
Detects the use of the GNU Debugger (gdb) to dump process memory (gcore) to disk, a technique abused by attackers to extract credentials residing in Runner.Worker. The rule specifically looks for process creation events where 'gdb' is in the command line along with process ID flags ('-p' or '--pid') and memory dumping commands ('dump memory' or 'gcore').
Detects unauthorized access to Windows Credential Manager vault
Detects attempts to dump LSASS memory for credential extraction
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
This rule detects attempts to copy the NTDS.dit Active Directory database file over SMB (Server Message Block) to a server. The rule specifically looks for the string "ntds.dit" within TCP traffic destined for port 445 (SMB). This activity is highly suspicious as the NTDS.dit file contains critical Active Directory information, including hashed user credentials, and its exfiltration is a common technique used by attackers for credential dumping.
This rule detects attempts to dump the Security Account Manager (SAM) hive using the 'reg save' command over HTTP. Specifically, it looks for HTTP requests containing 'reg save' and 'HKLM\SAM' in the URI, indicating an attempt to extract credential information from a Windows system.
This rule detects the delivery of a Windows Credential Manager dump tool over HTTP. It specifically looks for the case-insensitive string "CredEnumerate" within the file data of an HTTP response flowing to the client. This string is indicative of tools designed to interact with or dump credentials from the Windows Credential Manager.
This rule detects explicit references to popular PowerShell credential dumping tools, specifically 'Invoke-Mimikatz' and 'Invoke-Kerberoast', within executed PowerShell commands. It leverages native Defender XDR PowerShell command logging to identify these suspicious activities, which are indicative of credential access attempts.
This rule detects attempts to extract credentials from the Linux /proc filesystem over an SSH connection. Specifically, it looks for network traffic containing "/proc/", "/mem", and "ssh" (case-insensitive) within the same TCP flow to a server on port 22. This combination suggests an attacker might be trying to read sensitive memory regions or files related to SSH processes to dump credentials.
This rule detects attempts to dump NTDS.dit via the Volume Shadow Copy technique over HTTP. It specifically looks for HTTP URIs containing both 'vssadmin' and 'ntds.dit' (case-insensitive). This combination suggests an attacker is trying to exfiltrate the NTDS.dit file, which contains Active Directory database information, using the vssadmin utility to create a shadow copy and then access the file.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which are common targets for credential dumping. It specifically looks for Security Event ID 4656 (A handle to an object was requested) where the ObjectName is either 'lsass.exe' or 'ntds.dit' and the AccessMask indicates read or all access permissions. The rule then summarizes these events by user, computer, and IP address, flagging if two or more such events occur.
This rule detects the execution of known credential dumping tools, Mimikatz and ProcDump, when specific command-line arguments associated with credential extraction from LSASS are used. It specifically looks for `mimikatz.exe` or `procdump.exe` combined with arguments like `sekurlsa`, `logonpasswords`, or `-ma` which are commonly used to dump credentials from memory.
Detects inbound RPC calls to the Windows Remote Registry interface using operation numbers associated with registry save/backup operations, which may indicate credential dumping via remote registry access. This rule specifically looks for RPC UUID '338cd001-2244-31f1-aaaa-900038001003' and operation numbers 20 or 31, which correspond to registry save/backup functions.
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
This rule detects repeated access attempts (3 or more within an hour) to critical credential storage processes or files, specifically lsass.exe, the Security Account Manager (SAM) database, or the NTDS.dit file. Such activity is indicative of credential theft attempts by an adversary.
Page 27 of 38