Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects PHP SAPI processes accessing /proc/self/mem (or equivalent memory mapping) and subsequently spawning a Unix shell, which is characteristic of web shell activity or exploitation of PHP memory corruption/injection vulnerabilities like zif_system.
Detects process injection activities (such as remote thread creation, memory allocation, and writing to virtual memory) targeting common Windows background processes where the injecting process runs directly from the C:\Windows\ directory with a random or suspicious executable name.
Identifies available cross-process memory and thread manipulation telemetry events in DeviceEvents, tracking actions such as remote thread creation, virtual memory allocation, and process hollowing indicators before constructing process injection correlations.
The following analytic detects process injection into Notepad.exe using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to Notepad.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code within Notepad.exe. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment.
Detects potential mimikatz-like tools accessing LSASS from non system account
Detects process handle on LSASS process with certain access mask
Detects process access requests to LSASS process with potentially suspicious access flags
The following analytic detects attempts to read LSASS memory, indicative of credential dumping.
It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe.
It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe.
The following analytic detects possible credential dumping by identifying suspicious process access to LSASS with credential-dumping-related call traces.
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40).
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40).
The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. It leverages Sysmon logs, specifically EventCode 10, to identify suspicious call traces to dbgcore.dll and dbghelp.dll associated with lsass.exe. This activity is significant as it often precedes the theft of sensitive login credentials, posing a high risk of unauthorized access to systems and data. If confirmed malicious, attackers could gain access to critical credentials, enabling further compromise and lateral movement within the network.
The following analytic identifies non-SYSTEM accounts requesting access to lsass.exe. This detection leverages Sysmon EventCode 10 logs to monitor access attempts to the Local Security Authority Subsystem Service (lsass.exe) by non-SYSTEM users. This activity is significant as it may indicate credential dumping attempts or unauthorized access to sensitive credentials. If confirmed malicious, an attacker could potentially extract credentials from memory, leading to privilege escalation or lateral movement within the network. Immediate investigation is required to determine the legitimacy of the access request and to mitigate any potential threats.
This rule detects various methods used by adversaries to perform credential dumping from the Local Security Authority Subsystem Service (LSASS) process. It monitors for direct process access with suspicious handle permissions, the use of comsvcs.dll via rundll32.exe for MiniDump creation, the execution of memory dumping tools like procdump, and the creation of LSASS memory dump files by Task Manager.
This rule detects a multi-stage attack chain where a device shows signs of credential theft (accessing browser credential stores or cookies) followed closely by a successful cloud authentication from that same user using a device identifier not previously observed in the last 30 days.
Detects instances where a process contacts multiple distinct AI-provider domains within a short time frame while simultaneously performing suspicious operations, such as accessing the LSASS memory, executing process injection, or establishing WMI persistence. This pattern is indicative of a potential 'ClosedQuorum' adversary behavior involving data exfiltration or AI-assisted malicious activity.
Detects attempts to dump the Local Security Authority Subsystem Service (LSASS) process memory for credential harvesting. The rule monitors for unauthorized process access requests (e.g., PROCESS_VM_READ), suspicious file creation of memory dumps in common writeable directories, and command-line execution of tools or techniques commonly associated with LSASS dumping (e.g., Mimikatz, procdump, or abusing comsvcs.dll).
Detects a sequence indicative of credential harvesting and subsequent lateral movement propagation (e.g., NotPetya-style activity). The rule identifies processes accessing LSASS memory (credential dumping) followed within a one-hour window by network activity via SMB (TCP 445) or remote process execution via WMI.
Detects potential reflective DLL injection or process hollowing attempts by monitoring for high-privilege cross-process access (ProcessAccess EventID 10) or remote thread creation (CreateRemoteThread EventID 8). These methods are frequently used by attackers to execute malicious code within the memory space of a legitimate target process, thereby evading traditional signature-based detection.
Detects the 'mscopilot.exe' binary performing token manipulation operations (DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken) followed by the creation of a new process with a different security context (CreateProcessAsUserW) within a five-minute window, indicative of C2 agent functionality.
Detects credential-dumping modules (such as nanodump, hashdump, and lsadump variants) associated with AdaptixC2 framework being invoked or used by the 'mscopilot.exe' process. The rule monitors for command-line arguments indicating credential extraction, unauthorized attempts to open handle to lsass.exe, and access to sensitive registry hives (SAM, Security, LSA) by the suspect process.
Detects unauthorized processes attempting to open handles to the Local Security Authority Subsystem Service (lsass.exe) with sensitive access rights (e.g., PROCESS_VM_READ, PROCESS_QUERY_INFORMATION). These access patterns are frequently utilized by credential dumping tools like Mimikatz, ProcDump, or malicious abuse of system utilities to extract plaintext passwords or NTLM hashes from memory.
This rule detects unauthorized or suspicious processes attempting to access the memory of the Local Security Authority Subsystem Service (LSASS). It specifically targets memory access (EventID 10) with sensitive access masks (e.g., PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_VM_READ) originating from processes executing from suspicious locations such as Temp, AppData, Downloads, or randomly generated executable names. This method is often used by modern credential dumpers, such as those utilizing direct or indirect syscalls, to bypass userland security hooks.
Page 1 of 32