Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,440
11,814
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
This rule is to identify when the registry key (SYSTEM\CurrentControlSet\Control\SecurityProviders\ WDigest\UseLogonCredential OR SYSTEM\ControlSet00*\Control\SecurityProviders\ WDigest\UseLogonCredential) is modified signaling a possible WDigest downgrade attack, which was recently seen and attributed to the SmokedHam tool from UNC2465 and its affiliates.
This rule detects modifications to the NTDS.dit file, which is the Active Directory database. Adversaries often target this file to extract credentials and other sensitive information from domain controllers. Monitoring changes to this file can indicate an attempt at credential dumping or unauthorized access to Active Directory.
NTDS theft
KQL
Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.
Detects the execution of the hacktool Rubeus using specific command line flags within PowerShell script block logs. This rule identifies various Kerberos-related attacks such as AS-REPRoasting, Kerberoasting, Pass-the-Ticket, Golden Ticket, and Silver Ticket attacks, as well as credential harvesting and dumping.
Detects the execution of the hacktool Rubeus via PE information or command line parameters. Rubeus is a C# toolset designed for raw Kerberos interaction, often used for credential access, Kerberoasting, and pass-the-ticket attacks.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
This rule detects modifications to the Windows Registry key `HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential` where its value is set to `0x00000001`. This modification enables the WDigest protocol to store clear-text credentials in memory, making them vulnerable to credential dumping attacks. Adversaries often enable this setting to facilitate the extraction of user credentials from the Local Security Authority Subsystem Service (LSASS) process.
This rule detects attempts by a process to access the memory of 'svchost.exe' with a specific access right ('0x143a'), which is indicative of a credential dumping attempt. The rule filters out legitimate access from 'services.exe' and 'msiexec.exe' to reduce false positives.
The analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities such as Pass the Ticket, Pass the Hash, and credential dumping. This activity is significant as Mimikatz is a well-known tool used for credential theft and lateral movement. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
This rule detects suspicious execution patterns of rundll32.exe. Specifically, it looks for rundll32.exe being called with an obfuscated ordinal number (e.g., #+, #-, #0, #655, #656) which can be used by adversaries to obscure malicious code. Additionally, it identifies rundll32.exe attempting to perform a MiniDump of the 'comsvcs' process, which is a common technique for OS credential dumping.
this query combines Queries in a single Query created from Ayush Anand and published on https://www.securityinbits.com/detection-engineering/lsass-dump-comsvcs-rundll32/
this query combines Queries in a single Query created from Ayush Anand and published on https://www.securityinbits.com/detection-engineering/lsass-dump-comsvcs-rundll32/
The following analytic detects the behavior of dumping credentials from memory by exploiting the Local Security Authority Subsystem Service (LSASS) using the comsvcs.dll and MiniDump via rundll32. This detection leverages process information from Endpoint Detection and Response (EDR) logs, focusing on specific command-line executions. This activity is significant because it indicates potential credential theft, which can lead to broader system compromise, persistence, lateral movement, and privilege escalation. If confirmed malicious, attackers could gain unauthorized access to sensitive information, leading to data theft, ransomware attacks, or other damaging outcomes.
The analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. It leverages Sysmon logs, specifically EventCode 10, to identify suspicious call traces to dbgcore.dll and dbghelp.dll associated with lsass.exe. This activity is significant as it often precedes the theft of sensitive login credentials, posing a high risk of unauthorized access to systems and data. If confirmed malicious, attackers could gain access to critical credentials, enabling further compromise and lateral movement within the network.
This rule detects an unusually high number of outbound network connections originating from the Local Security Authority Subsystem Service (LSASS) process on a Windows machine. LSASS is a critical system process responsible for enforcing security policy on the system, including user authentication, and typically does not initiate a large number of outbound connections. A high count of outbound connections from LSASS could indicate credential dumping activity, where an attacker is exfiltrating harvested credentials, or other malicious activity compromising the LSASS process.
This analytic detects attempts to read LSASS memory, indicative of credential dumping. It leverages Sysmon EventCode 10, filtering for specific access permissions (0x1010 and 0x1410) on the lsass.exe process. This activity is significant because it suggests an attacker is trying to extract credentials from LSASS memory, potentially leading to unauthorized access, data breaches, and compromise of sensitive information. If confirmed malicious, this could enable attackers to escalate privileges, move laterally within the network, or exfiltrate data. Extensive triage is necessary to differentiate between malicious and benign activities.
The analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS) process, identified using Sysmon EventID 8 logs. This activity is a strong indicator of credential dumping, a tactic used by adversaries to steal user authentication credentials. Successful exploitation could lead to unauthorized access to sensitive information and potential network compromise. Analysts should investigate to distinguish between legitimate tools and malicious activity.
The analytic identifies non-SYSTEM accounts requesting access to lsass.exe. This detection leverages Sysmon EventCode 10 logs to monitor access attempts to the Local Security Authority Subsystem Service (lsass.exe) by non-SYSTEM users. This activity is significant as it may indicate credential dumping attempts or unauthorized access to sensitive credentials. If confirmed malicious, an attacker could potentially extract credentials from memory, leading to privilege escalation or lateral movement within the network. Immediate investigation is required to determine the legitimacy of the access request and to mitigate any potential threats.
The following analytic identifies processes attempting to access Lsass.exe, which may indicate credential dumping or applications needing credential access. It leverages Sysmon EventCode 10 to detect such activities by analyzing fields like TargetImage, GrantedAccess, and SourceImage. This behavior is significant as unauthorized access to Lsass.exe can lead to credential theft, posing a severe security risk. If confirmed malicious, attackers could gain access to sensitive credentials, potentially leading to privilege escalation and further compromise of the environment.
This rule detects instances where 'WerFaultSecure.exe' is launched by an unusual parent process. 'WerFaultSecure.exe' is a legitimate Windows error reporting tool, but its execution by non-standard parent processes can indicate malicious activity, such as process injection, credential dumping, or defense evasion. The rule assigns a suspicion score based on the parent process and command-line parameters, filtering for medium to critical risk levels. It also extracts the target PID and identifies suspicious parameters or dump types.
This rule detects the use of 'esentutl.exe' to copy sensitive files containing credential data, such as the Security Account Manager (SAM) database or the NTDS.dit file. It specifically looks for command-line arguments indicative of Volume Shadow Copy operations or direct paths to known sensitive files within the 'config', 'repair', or 'windows\ntds' directories.
Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory. This tool, while legitimate, can be abused by adversaries to extract sensitive information, such as credentials, from process memory. The rule specifically looks for the execution of rdrleakdiag.exe with command-line arguments indicative of memory dumping, such as '/memdmp' or 'fullmemdmp', along with output and process specification arguments.
This analytic detects a user account initiating an Active Directory replication request, indicative of a DCSync attack. It leverages EventCode 4662 from the Windows Security Event Log, focusing on specific object types and replication permissions. This activity is significant because it can allow an attacker with sufficient privileges to request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of the entire domain.
Page 30 of 38