Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,427
11,813
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects the execution of HandleKatz, a tool designed to dump LSASS memory using cloned handles. The rule identifies the tool by its executable name ('loader.exe'), specific command-line arguments including '--pid:', '--outfile:', and keywords like '.dmp', 'lsass', '.obf', or 'dump', and known IMPHASH values associated with HandleKatz.
Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process with suspicious access masks. Adversaries often target LSASS to dump credentials for lateral movement or privilege escalation. The rule looks for specific access mask values in Windows Security Event IDs 4656 (handle requested) and 4663 (object access attempt) that are indicative of credential dumping activities, while filtering out known legitimate processes.
Detects the creation of files with names commonly used by various memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. This includes specific filenames and patterns associated with tools like Procdump, MirrorDump, PPLBlade, RustiveDump, NativeDump, and Nanodump.
Detects suspicious process access requests to the LSASS process using specific GrantedAccess flags. These flags are often associated with tools and techniques used for credential dumping, such as Mimikatz, by attempting to read or manipulate LSASS memory to extract credentials. The rule includes filters for common legitimate processes like antivirus software, EDRs, and system utilities to reduce false positives.
Detects attempts to dump Active Directory credentials using Impacket's secretdump tool. This rule specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) on the ADMIN$ share, combined with access to a temporary file within the SYSTEM32 directory. This pattern is indicative of secretdump's remote activity to extract credential hashes.
This rule detects Mimikatz DCSync activity by monitoring Windows Security Event ID 4662. Specifically, it looks for access attempts to replicate directory changes (identified by specific GUIDs) with an AccessMask of '0x100'. To reduce false positives, it filters out activity from 'Window Manager' and service accounts starting with 'NT AUT', 'MSOL_', or ending with '$'.
Detects remote credential dumping activity using Impacket's secretdump tool by monitoring SMB file access patterns. Specifically, it looks for access to the ADMIN$ share with paths containing 'SYSTEM32\' and ending with '.tmp', which is characteristic of secretdump creating temporary files during its operation.
Detects potential abuse of ntdsutil or similar methods to dump the ntds.dit database. This activity is often associated with credential dumping from Active Directory.
This rule detects the execution of well-known credential dumping tools by monitoring Windows Security Event ID 4697, which signifies a service creation event. The rule specifically looks for service filenames containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This indicates an adversary attempting to install and run a service that can extract credentials from the system.
This rule detects the use of Mimikatz by looking for specific keywords associated with its modules and functionalities within Windows Event Logs. These keywords cover various Mimikatz features, including credential dumping (LSASS, SAM, LSA secrets), Kerberos ticket manipulation (golden ticket, pass-the-ticket), DPAPI masterkey extraction, and other miscellaneous functions. Some keywords may be more prevalent in older Mimikatz versions but are still used by threat actors.
This rule detects the execution of well-known credential dumping tools by monitoring Windows System event logs for Service Control Manager events (EventID 7045) indicating service creation. The rule specifically looks for service image paths containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This helps identify attempts to install and run these tools as services for credential theft.
This rule detects the presence of keywords commonly associated with well-known PowerShell exploitation frameworks such as Mimikatz and Metasploit within PowerShell script blocks. The keywords indicate attempts to perform privileged operations like manipulating access tokens, reading process memory, or other actions typically involved in credential dumping and privilege escalation. Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Detects when a process attempts to add or modify a network provider by manipulating the Windows Registry, specifically targeting the 'NetworkProvider' key within 'System\CurrentControlSet\Services\'. This activity is indicative of potential credential dumping attempts, similar to techniques used by tools like NPPSpy, which can register a malicious network provider DLL to capture cleartext credentials during the authentication process.
This rule detects the execution of Mimikatz by identifying specific command-line arguments and keywords commonly associated with its various modules and functions. It looks for terms like 'DumpCreds', 'mimikatz', and module-specific keywords such as '::aadcookie', '::detours', 'sekurlsa::', 'kerberos::', and 'lsadump::'. The rule aims to identify attempts to dump credentials or perform other malicious actions using the Mimikatz tool.
This rule detects the creation of files with names commonly associated with credential dumping tools or the output files generated by such tools. This includes executables of known credential dumpers like fgdump, pwdump, cachedump, procdump, and Windows Credential Editor (WCE), as well as output files like 'fgdump-log', 'kirbi', 'pwdump', 'pwhashes', 'wce_ccache', 'wce_krbtkts', 'NTDS.out', 'SAM.out', 'SECURITY.out', and 'SYSTEM.out'.
Detects a PowerShell process attempting to access the Local Security Authority Subsystem Service (LSASS) process memory. This activity is a strong indicator of potential credential dumping attempts, where an attacker tries to extract sensitive authentication material (like passwords or hashes) from memory.
Detects Windows error reporting events where the Local Security Authority Subsystem Service (LSASS) process crashes with a specific exception code. This behavior can indicate an intentional crash, often associated with techniques like Lsass-Shtinkering, to facilitate credential dumping from LSASS memory.
Detects password dumper activity by monitoring remote thread creation (EventID 8) where the target process is 'lsass.exe'. The process initiating the remote thread is the malicious program. A single execution of such a tool can generate numerous events.
This rule detects the execution of the `Get-ADReplAccount` cmdlet from the DSInternals PowerShell module with specific parameters (`-All` and `-Server`). This cmdlet is used to perform a DCSync attack, which allows an attacker to retrieve password hashes and other sensitive Active Directory information by simulating a domain controller replication. The DSInternals module provides advanced capabilities for Active Directory manipulation and auditing, and its use in this manner is highly suspicious and indicative of credential access attempts.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory from non-system accounts, which is a common technique used by credential dumping tools like Mimikatz. The rule specifically looks for security events (4663 or 4656) related to process object access with specific access masks targeting 'lsass.exe', while filtering out legitimate system accounts and known benign processes.
Page 36 of 38