Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,427
11,813
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects the registration of a new ODBC driver where the driver's DLL is located in a potentially suspicious or non-standard system directory. Adversaries may use this technique to establish persistence or facilitate credential access by registering malicious ODBC drivers.
Detects the use of the PowerShell cmdlet 'Get-StorageDiagnosticInfo' with the '-IncludeLiveDump' parameter to dump the live memory of a Windows machine. This technique can be used by adversaries to extract sensitive information, including credentials, from memory.
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass
Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process. This way we are also able to catch cases in which the attacker has renamed the procdump executable. Procdump dump of lsass using minidump or memory dump options. Covers atomic tests 1 and 8
Detects the use of the Microsoft Windows Resource Leak Diagnostic tool rdrleakdiag.exe to dump process memory
Detects process launches from processes related to ntds against key servers
CreateDump Process Dump
YARA-L
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up
Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory
Detection well-known mimikatz command line arguments
Detects the presence of the keywords lsass and .dmp in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process
Detects LSASS process access requests from a source process with the dump keyword in its image name
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects when an account successfully recovers a Local Administrator Password Solution (LAPS) password from Microsoft Entra ID. This activity is logged in Azure audit logs under the 'Device' category with the activity type 'Recover device local administrator password' and additional details indicating 'Successfully recovered local credential by device id'. This event can signify an attacker attempting to gain elevated privileges or maintain persistence by obtaining local administrator credentials.
This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signature 61514 (Veeam Backup and Replication credential dump attempt) is followed within a 5-minute window by 64795 (Veeam Backup and Replication xp_cmdshell invocation attempt), which detects the use of `xp_cmdshell`, a common post-exploitation technique. If confirmed malicious, this behavior is highly indicative of a successful exploitation of CVE-2023-27532, followed by remote command execution or credential dumping.
Detects extraction of ntds.dit file using vssadmin.exe or ntdsutil.exe with wmic as identified in CISA Living off the Land pdf
Detects the process mimikatz being issued from the command line.
Detects the execution and usage of the DSInternals PowerShell module. This module can be used to perform suspicious activities such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, recovering domain controllers from IFM backups, and calculating password hashes. The rule specifically looks for a wide range of cmdlets associated with the DSInternals module within PowerShell script block logs.
This analytic detects attempts to dump credentials from a shadow copy using the copy command. It specifically looks for processes executing commands that reference critical credential files like "sam", "security", "system", and "ntds.dit" within system directories. Such activity is a strong indicator of credential extraction, which can lead to unauthorized access, privilege escalation, lateral movement, and sensitive data compromise.
Page 34 of 38