Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,427
11,813
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
This rule detects the execution of Mimikatz or Mimikatz-like tools by looking for specific command-line arguments commonly used by the tool. Mimikatz is a well-known post-exploitation tool used to extract plaintext passwords, hash, PIN codes, and Kerberos tickets from memory, particularly from the Local Security Authority Subsystem Service (LSASS) process. The rule identifies various Mimikatz modules and commands such as "dumpcreds", "mimikatz", "::aadcookie", "::detours", "::memssp", "::mflt", "::ncroutemon", "::ngcsign", "::printnightmare", "::skeleton", "::preshutdown", "::mstsc", "::multirdp", "rpc::", "token::", "crypto::", "dpapi::", "sekurlsa::", "kerberos::", "lsadump::", "privilege::", "process::", and "vault::". Detection of these arguments indicates an attempt to perform credential access or privilege escalation.
This rule detects attempts to dump credentials from the Local Security Authority Subsystem Service (LSASS) process using `WerFault.exe`. It specifically looks for `WerFault.exe` accessing `lsass.exe` with a specific access mask (`0x1FFFFF`), which is indicative of memory dumping tools like Mimikatz, NanoDump, Invoke-Mimikatz, Procdump, or Taskmgr. This technique is often used by adversaries to extract credentials for lateral movement or persistence.
This rule detects the presence of keywords related to LSASS (Local Security Authority Subsystem Service) memory dumping in process command lines. Adversaries often dump LSASS memory to extract credentials such as plaintext passwords, NTLM hashes, and Kerberos tickets. The rule specifically looks for combinations of "lsass" with dump file extensions like ".dmp", ".zip", ".rar", or other common dump-related keywords like "lsassdump", "lsassdmp", "nanodump", and "sqldmpr". This activity is a strong indicator of an attempt to steal credentials from the system.
This rule detects the creation of files with specific names or patterns commonly used by memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule looks for file creation events where the file path contains keywords like 'lsass', 'nanodump', 'sqldmpr', or specific filenames such as 'Andrew.dmp', 'Coredump.dmp', 'lsass.dmp', 'lsass.rar', 'lsass.zip', 'NotLSASS.zip', 'PPLBlade.dmp', and 'rustive.dmp'. This activity is indicative of an attempt to dump LSASS memory, which contains sensitive user credentials.
This rule detects attempts to dump the Local Security Authority Subsystem Service (LSASS) memory using `rundll32.exe` to call the `MiniDump` export function from `comsvcs.dll`. This technique is commonly used by adversaries to extract credentials from a compromised system.
This rule detects the creation of a file named 'dumpert.dmp' which is the default output file name used by the Outflank Dumpert tool. Outflank Dumpert is a known tool used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process, typically for credential harvesting.
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behavior is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager, which is a common technique for credential access.
This rule detects the creation of files with names commonly associated with credential dumping tools or files produced by them. It looks for specific filenames or patterns in the full path of newly created files, such as logs from fgdump, kirbi files, pwdump outputs, cachedump executables, procdump outputs, and Windows Credential Editor (WCE) related files. This indicates an attempt to extract credentials from the system.
Detects suspicious uses of the SysInternals Procdump utility by using specific command line parameters (`-ma` or `-mm`) in combination with the `lsass.exe` process. This rule aims to catch instances where an attacker might rename the Procdump executable but still uses its characteristic command-line arguments to dump LSASS memory. It covers scenarios described in atomic tests 1 and 8 related to Procdump memory dumping.
This rule detects modifications to the Windows Registry related to the SilentProcessExit mechanism for the lsass.exe process. Specifically, it looks for changes in the registry key path 'microsoft\windows nt\currentversion\silentprocessexit\lsass.exe'. This technique can be abused by adversaries to configure a monitor program to dump the memory of the lsass.exe process, which often contains sensitive credential information.
Detects the use of the Microsoft Windows Resource Leak Diagnostic tool rdrleakdiag.exe to dump process memory. This tool can be abused by adversaries to extract sensitive information, such as credentials, from process memory.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory by other processes. Specifically, it triggers when a process attempts to open lsass.exe and the accessing process's image name (full path) contains the keyword "dump". This behavior is indicative of tools used for credential dumping, such as Mimikatz or similar utilities, which often include "dump" in their filenames or paths.
This rule detects attempts to dump process memory, specifically targeting the Local Security Authority Subsystem Service (LSASS) process, using `rundll32.exe` and `comsvcs.dll`. This technique is commonly used by adversaries to extract credentials from memory. The rule looks for `rundll32.exe` executing with `comsvcs.dll` and specific keywords like 'full', 'minidump', or numerical arguments (e.g., '24', '#-') that indicate a memory dump operation.
This rule detects the execution of the `createdump.exe` utility, or a renamed version of it, when used to dump process memory. It specifically looks for command-line arguments indicative of memory dumping, such as combinations of `-u`, `-f`, and `.dmp` or `--full`, `--name`, and `.dmp`. The rule explicitly excludes instances where the executable is named `createdump.exe` to focus on renamed binaries, which is a common evasion technique.
This rule detects attempts by known hacktool processes to access other processes. It specifically looks for 'PROCESS_OPEN' events where the principal process's image name matches a predefined list of hacktool patterns. This behavior is often indicative of credential dumping or other malicious activities where a tool needs to interact with another process's memory space, such as LSASS.
Detects the execution of Dumpert, a tool used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process. This rule identifies Dumpert activity by looking for specific import hashes (imphash) associated with the tool or by detecting the string "dumpert.dll" in the command line of a launched process.
This rule detects the execution of the Mimikatz tool by looking for the string "mimikatz" (case-insensitive) in the command line of newly launched processes. Mimikatz is a well-known credential dumping tool often used by adversaries to extract plaintext passwords, hash, PIN codes, and Kerberos tickets from memory.
Detects the launch of specific utilities (like ntdsutil, vssadmin, diskshadow, esentutl) on key servers. These utilities can be used by adversaries to access or copy the Active Directory domain database (NTDS.dit) or inhibit system recovery, which are common techniques for credential dumping and persistence.
This rule detects attempts to extract the ntds.dit file, which contains Active Directory credential information, using `wmic` in conjunction with `vssadmin.exe` or `ntdsutil.exe`. It also identifies the creation of `.dit` files in temporary directories and specific ESENT application event logs associated with NTDS database activity. This activity is indicative of credential dumping, a common post-exploitation technique.
The analytic detects the use of `reg.exe` to export Windows Registry hives, specifically `sam`, `system`, or `security`, which may contain sensitive credentials. This activity indicates potential offline credential access attacks, often executed from untrusted processes or scripts. If confirmed malicious, attackers could gain access to credential data, enabling further compromise and lateral movement within the network.
Page 33 of 38