Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
779 detections
Filters
Last updated
All Time
Detection languages
350
123
77
74
64
Contributors
208
176
72
63
49
Categories
20,427
11,813
5,871
5,145
4,864
779
Platforms
737
19
17
10
9
Products / Services
277
276
211
90
42
MITRE Techniques
516
372
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects unauthorized processes attempting to access the memory of the Local Security Authority Subsystem Service (LSASS) with high-privilege access masks, a technique commonly used for credential dumping to harvest passwords and authentication tokens.
Detects unauthorized processes requesting memory access to lsass.exe with read permissions commonly associated with credential dumping techniques like Mimikatz. It identifies remote handle requests to lsass.exe, which are frequently used by tools deployed via network services or remote execution methods to extract credentials from memory.
Detects anomalous MS-DRSR DRSGetNCChanges requests occurring between hosts where the requester is not a recognized Domain Controller. This pattern is commonly used by attackers to perform a DCSync attack, allowing for the replication of sensitive Active Directory data such as user password hashes.
Detects Active Directory Directory Replication Service (DRSUAPI) GetNCChanges requests originating from a principal or host that is not recognized as a Domain Controller. This behavior is indicative of unauthorized DCSync operations used to dump NTDS.dit hashes, a common technique for credential harvesting associated with ransomware actors like Qilin.
Detects credential dumping attempts against the Local Security Authority Subsystem Service (LSASS) process. The rule identifies processes attempting to access LSASS memory using specific access masks often associated with credential extraction, or the presence of the Mimikatz 'sekurlsa::logonpasswords' command in the process command line.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
This rule detects LSASS credential dumping attempts by correlating the execution of a dump command (via process command line) with the subsequent creation of a temporary file in the Windows Temp directory. The rule is specifically designed to bypass evasion techniques that introduce randomized delays between the LSASS process access and the file write operation by utilizing a 30-minute join window.
Detects the pidclone-style LSASS credential dumper that clones the target process into a suspended state, mirrors its memory, generates a minidump, and writes an XOR-encrypted copy of the dump to a randomized filename under Windows\Temp
Detects a sequence of events indicative of LSASS memory dumping where a process opens a handle to lsass.exe and subsequently creates a uniquely named temporary file (16-character hexadecimal filename) in the Windows Temp directory within a short timeframe. This behavior is often associated with the obfuscated flushing of a stolen memory dump to disk to evade signature-based detection.
Detects the execution of pypykatz or Python scripts invoking pypykatz commands to perform credential dumping, specifically targeting LSASS memory or minidump files.
Detects command-line activity indicative of attempts to dump LSASS memory after performing in-memory unhooking or bypassing of security monitoring DLLs (ntdll.dll, amsi.dll, win32kbase.sys). This behavior is characteristic of adversaries attempting to harvest credentials while evading EDR/AV visibility.
Detects a process initiating a memory dump of lsass.exe (using --dump arguments) followed within 15 minutes by the creation of a hexadecimal-named .tmp file in the Windows\Temp directory. This behavioral pattern is characteristic of credential dumping using reflected cloning or similar techniques, followed by the staging of obfuscated or encrypted minidump data for exfiltration.
This rule detects LSASS credential dumping attempts by correlating the execution of a dump command (via process command line) with the subsequent creation of a temporary file in the Windows Temp directory. The rule is specifically designed to bypass evasion techniques that introduce randomized delays between the LSASS process access and the file write operation by utilizing a 30-minute join window.
Detects the use of rundll32.exe to execute comsvcs.dll's MiniDump functionality against the LSASS process, a common technique for dumping credentials. The rule includes behavioral correlation by identifying the same user account executing this pattern on multiple devices within a one-hour window.
Detects the use of rundll32.exe to execute comsvcs.dll's MiniDump functionality against the LSASS process, a common technique for dumping credentials. The rule includes behavioral correlation by identifying the same user account executing this pattern on multiple devices within a one-hour window.
Detects the use of the native Windows reg.exe utility to save the Security Account Manager (SAM) registry hive to a file. This technique is commonly used by adversaries to perform offline credential extraction or to dump local account password hashes.
Detects a sequence of events consistent with credential dumping of sensitive Windows registry hives (SAM, SYSTEM, SECURITY). The attack involves querying shadow copies using vssadmin, creating a symbolic link to the shadow copy volume via mklink, and copying the hive files from that location. Cleanup attempts using rmdir are also monitored.
Detects a sequence of activity characteristic of lateral movement and credential theft: the deployment or execution of PsExec service followed by the use of Windows utilities (vssadmin, ntdsutil, esentutl) to perform Volume Shadow Copy-based extraction of the NTDS.dit database or SYSTEM hive on the same host.
Detects two distinct behaviors indicative of potential credential theft or lateral movement: DCSync-style Active Directory replication requests identified via Event ID 4662 with specific replication GUIDs, and high-volume SMB traffic originating from Domain Controllers or DC-adjacent hosts, which may indicate unauthorized data access or credential dumping activities.
Detects two distinct behaviors indicative of potential credential theft or lateral movement: DCSync-style Active Directory replication requests identified via Event ID 4662 with specific replication GUIDs, and high-volume SMB traffic originating from Domain Controllers or DC-adjacent hosts, which may indicate unauthorized data access or credential dumping activities.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy sensitive files, specifically the NTDS.dit database or the SYSTEM registry hive, from that shadow copy. This behavior is indicative of an attempt to perform offline credential theft.
Page 6 of 38