Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
LSASS Dump via comsvcs.dll MiniDump
Cortex XDR
This hunt detects potential credential dumping activity leveraging rundll32.exe to invoke the MiniDump function from comsvcs.dll, a known technique used to dump the memory of sensitive processes like LSASS.
Attackers abuse this method because it uses legitimate Windows binaries (Living-off-the-Land Binaries - LOLBins), making detection harder. This behavior is strongly associated with credential access techniques such as MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory).
The presence of comsvcs.dll combined with MiniDump in the command line is a high-fidelity indicator of suspicious or malicious activity, often used by red teams and real-world adversaries.
Attackers abuse this method because it uses legitimate Windows binaries (Living-off-the-Land Binaries - LOLBins), making detection harder. This behavior is strongly associated with credential access techniques such as MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory).
The presence of comsvcs.dll combined with MiniDump in the command line is a high-fidelity indicator of suspicious or malicious activity, often used by red teams and real-world adversaries.
This hunt identifies potential credential dumping activity by detecting known dump tools such as procdump.exe, rundll32.exe, and taskmgr.exe creating memory dump files (.dmp) in suspicious or attacker-preferred directories.
Adversaries often store LSASS dumps in locations like:
- Temp directories
- ProgramData
- Public folders
These paths are commonly used because they are writable, less monitored, and blend in with normal system activity. The presence of dump files in these locations, especially when created by known dumping tools, it is a strong indicator of malicious credential access attempts.
Adversaries often store LSASS dumps in locations like:
- Temp directories
- ProgramData
- Public folders
These paths are commonly used because they are writable, less monitored, and blend in with normal system activity. The presence of dump files in these locations, especially when created by known dumping tools, it is a strong indicator of malicious credential access attempts.
LSASS Dump via comsvcs.dll MiniDump
Cortex XDR
This hunt detects potential credential dumping activity leveraging rundll32.exe to invoke the MiniDump function from comsvcs.dll, a known technique used to dump the memory of sensitive processes like LSASS.
Attackers abuse this method because it uses legitimate Windows binaries (Living-off-the-Land Binaries - LOLBins), making detection harder. This behavior is strongly associated with credential access techniques such as MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory).
The presence of comsvcs.dll combined with MiniDump in the command line is a high-fidelity indicator of suspicious or malicious activity, often used by red teams and real-world adversaries.
Attackers abuse this method because it uses legitimate Windows binaries (Living-off-the-Land Binaries - LOLBins), making detection harder. This behavior is strongly associated with credential access techniques such as MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory).
The presence of comsvcs.dll combined with MiniDump in the command line is a high-fidelity indicator of suspicious or malicious activity, often used by red teams and real-world adversaries.
This hunt identifies potential credential dumping activity by detecting known dump tools such as procdump.exe, rundll32.exe, and taskmgr.exe creating memory dump files (.dmp) in suspicious or attacker-preferred directories.
Adversaries often store LSASS dumps in locations like:
- Temp directories
- ProgramData
- Public folders
These paths are commonly used because they are writable, less monitored, and blend in with normal system activity. The presence of dump files in these locations, especially when created by known dumping tools, it is a strong indicator of malicious credential access attempts.
Adversaries often store LSASS dumps in locations like:
- Temp directories
- ProgramData
- Public folders
These paths are commonly used because they are writable, less monitored, and blend in with normal system activity. The presence of dump files in these locations, especially when created by known dumping tools, it is a strong indicator of malicious credential access attempts.
LSASS Dump via comsvcs.dll MiniDump
Cortex XDR
This hunt detects potential credential dumping activity leveraging rundll32.exe to invoke the MiniDump function from comsvcs.dll, a known technique used to dump the memory of sensitive processes like LSASS.
Attackers abuse this method because it uses legitimate Windows binaries (Living-off-the-Land Binaries - LOLBins), making detection harder. This behavior is strongly associated with credential access techniques such as MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory).
The presence of comsvcs.dll combined with MiniDump in the command line is a high-fidelity indicator of suspicious or malicious activity, often used by red teams and real-world adversaries.
Attackers abuse this method because it uses legitimate Windows binaries (Living-off-the-Land Binaries - LOLBins), making detection harder. This behavior is strongly associated with credential access techniques such as MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory).
The presence of comsvcs.dll combined with MiniDump in the command line is a high-fidelity indicator of suspicious or malicious activity, often used by red teams and real-world adversaries.
This hunt identifies potential credential dumping activity by detecting known dump tools such as procdump.exe, rundll32.exe, and taskmgr.exe creating memory dump files (.dmp) in suspicious or attacker-preferred directories.
Adversaries often store LSASS dumps in locations like:
- Temp directories
- ProgramData
- Public folders
These paths are commonly used because they are writable, less monitored, and blend in with normal system activity. The presence of dump files in these locations, especially when created by known dumping tools, it is a strong indicator of malicious credential access attempts.
Adversaries often store LSASS dumps in locations like:
- Temp directories
- ProgramData
- Public folders
These paths are commonly used because they are writable, less monitored, and blend in with normal system activity. The presence of dump files in these locations, especially when created by known dumping tools, it is a strong indicator of malicious credential access attempts.
Detects a Python process attempting to read the memory (`/proc/<pid>/mem` or `/maps`) of a GitHub Actions `Runner.Worker` process. This is indicative of the credential dumping technique used by the TeamPCP threat actor during the Trivy supply chain compromise to extract highly privileged injected secrets.
This rule detects the use of the 'makecab.exe' utility to compress the Active Directory database (ntds.dit) or the SYSTEM registry hive. This is a technique used by attackers to prepare credentials and system secrets for exfiltration, as observed in intrusions following FortiGate compromises.
This rule detects the presence of MicroStealer malware by matching known MD5, SHA1, or SHA256 hashes of its binaries against file events on monitored devices. MicroStealer is a credential stealer that targets various applications to exfiltrate sensitive information.
Detects the execution of LsaRecorder, a credential dumping tool used by CL-UNK-1068.
This rule detects activity associated with a specific threat actor targeting FortiGate devices. It identifies network connections to known threat actor infrastructure IPs, attempts to access FortiGate management ports (443, 8443, 10443, 4443) over TCP, and successful administrative or VPN authentications from the threat actor's IPs in Fortinet/FortiGate logs. Additionally, it looks for DCSync-style directory replication access (event ID 4662) in Windows Security logs, indicating potential Active Directory compromise.
Detects a process requesting read access (GrantedAccess 0x1010) to the LSASS process memory (lsass.exe). This technique is commonly used by threat actors to dump credentials for lateral movement and ransomware deployment. The rule specifically looks for the GrantedAccess value '0x1010', which corresponds to PROCESS_VM_READ and PROCESS_QUERY_INFORMATION access rights, and excludes a list of known legitimate processes.
This rule detects potential DCSync replication abuse by monitoring Security Event ID 4662, specifically looking for access to 'domainDNS' or user objects with the GUID '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2', which is associated with Directory Replication Service (DRS) permissions. It filters out machine accounts to reduce false positives.
Detects access to VMware virtual disk files (.vmdk). This technique was
observed being used by the Muddled Libra (Scattered Spider) threat group,
where they would power down Domain Controllers, mount their disks to a rogue
VM, and steal the NTDS.dit and SYSTEM hives for offline credential extraction.
This method bypasses security monitoring that would typically occur on the
Domain Controller itself.
observed being used by the Muddled Libra (Scattered Spider) threat group,
where they would power down Domain Controllers, mount their disks to a rogue
VM, and steal the NTDS.dit and SYSTEM hives for offline credential extraction.
This method bypasses security monitoring that would typically occur on the
Domain Controller itself.
Detects the execution of wbadmin.exe with command line arguments used to back up or restore sensitive Active Directory database (NTDS.dit) or registry hives (SYSTEM). This is a common technique for credential dumping.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
Detects the use of GDB (GNU Debugger) to dump the memory of a running process. This technique is used by frameworks like ShadowHS to extract credentials and other secrets from live processes without writing traditional credential dumping tools to disk.
Detects the execution of Mimikatz for credential dumping shortly after the WDigest 'UseLogonCredential' registry key is enabled. This combination of TTPs is associated with the Qilin ransomware group.
The rule detects potential exploitation attempts by identifying a single source IP that generates a high number of connection events (>= 100) but a very low rate of client metadata exchanges (<= 10%). This pattern, combined with a high connection rate, is strong evidence of an anomalous interaction consistent with a network-based vulnerability scan or exploitation attempt.
Detects creation of branches and files matching indicators used by Shai-Hulud 2.0 for exfiltration
Detects GitHub Actions activity matching indicators used by Shai-Hulud 2.0 for exfiltration and persistence
Page 29 of 38