Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects a process obtaining handle access to the LSASS process (Sysmon Event ID 10) followed by the creation of a file (Sysmon Event ID 11) using an extension other than '.dmp'. This behavior is characteristic of adversaries attempting to obfuscate credential dumping activities by bypassing simple extension-based detection rules.
Detects unauthorized attempts to dump credentials from the Local Security Authority Subsystem Service (LSASS) process. This includes the execution of known credential-harvesting tools (e.g., Mimikatz, LaZagne, pypykatz), the use of system utilities like procdump and comsvcs.dll to dump process memory, and anomalous direct handle access to lsass.exe by non-system processes. This activity is associated with Storm-2570 post-compromise tradecraft.
Detects a multi-stage activity chain indicative of infostealer malware, including reading the browser 'Local State' file (containing the master key), accessing a browser process (likely for memory dumping or token extraction), and initiating an immediate outbound network connection to an external destination.
Detects unauthorized access to Windows camera or microphone consent store registry keys by either a suspected Kothamine agent masquerading as 'MicrosoftEdgeUpdateCore.exe' or an injected 'explorer.exe'. The rule correlates these registry access events with the presence of specific Kothamine-related file artifacts (MicrosoftEdgeUpdateCore.dll and tailcat.exe) on the same host within a 24-hour window to minimize noise.
Detects unauthorized access to Windows camera or microphone consent store registry keys by either a suspected Kothamine agent masquerading as 'MicrosoftEdgeUpdateCore.exe' or an injected 'explorer.exe'. The rule correlates these registry access events with the presence of specific Kothamine-related file artifacts (MicrosoftEdgeUpdateCore.dll and tailcat.exe) on the same host within a 24-hour window to minimize noise.
Detects attempts to create a memory dump of the Local Security Authority Subsystem Service (LSASS) using either the built-in 'comsvcs.dll' library via 'rundll32.exe' or by requesting specific sensitive process access rights to 'lsass.exe' from unauthorized processes.
Detects attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process, a technique commonly used by adversaries to harvest domain credentials and clear-text passwords from memory.
Detects unauthorized processes attempting to open handles to the Local Security Authority Subsystem Service (LSASS) process with access rights consistent with credential dumping (e.g., PROCESS_VM_READ, PROCESS_ALL_ACCESS). This rule also specifically flags the use of well-known tools and techniques such as Mimikatz, ProcDump, and the abuse of rundll32.exe with comsvcs.dll for memory extraction, which is indicative of OS Credential Dumping (T1003.001).
This rule detects potential process injection or process hollowing attempts by correlating Sysmon Event ID 10 (ProcessAccess) events indicating process memory modification permissions (such as PROCESS_VM_WRITE and PROCESS_CREATE_THREAD) with subsequent Sysmon Event ID 8 (CreateRemoteThread) events targeting the same process. This behavior is indicative of an adversary injecting malicious code into a legitimate host process (e.g., svchost.exe, explorer.exe).
This rule detects potentially malicious in-memory module loading, such as Beacon Object File (BOF) execution, on hosts already identified as exhibiting suspicious behavior related to MLTBackdoor or sideloading activity. It monitors for memory allocation or protection changes (AllocateVirtualMemory, VirtualProtect, CreateRemoteThread) that result in executable memory (RWX or execute-only) without a corresponding file on disk, which is a common indicator of fileless code injection.
Correlates a sequence of suspicious activities on a single host within 90 minutes: LSASS memory access consistent with credential dumping, followed by remote service or WMI-based lateral movement, and finishing with mass file renames or modifications characteristic of ransomware encryption.
Detects Sysmon Event ID 10 (ProcessAccess) events where a process opens lsass.exe with a GrantedAccess mask matching known credential-dumping access rights (e.g. PROCESS_VM_READ combinations used by Mimikatz/ProcDump-style tooling), excluding common legitimate EDR/AV/diagnostic source processes.
Detects a sequence of potentially malicious actions indicative of credential theft, including LSASS memory access for dumping, followed by the acquisition of browser or cryptocurrency wallet files, and the subsequent staging of data in temporary directories, all correlated by the same process and device within a 15-minute window.
Detects the execution of attrib.exe spawned by known Sauron Loader process names (rnpkeys.exe, rnp.exe, or tdwp.exe). The rule flags instances where attrib.exe is executed without its typical command-line arguments (file attribute flags), suggesting it is being used as a surrogate process for injected C2-tasked shellcode.
Detects unauthorized access to Windows camera or microphone consent store registry keys by either a suspected Kothamine agent masquerading as 'MicrosoftEdgeUpdateCore.exe' or an injected 'explorer.exe'. The rule correlates these registry access events with the presence of specific Kothamine-related file artifacts (MicrosoftEdgeUpdateCore.dll and tailcat.exe) on the same host within a 24-hour window to minimize noise.
Detects unauthorized access to Windows camera or microphone consent store registry keys by either a suspected Kothamine agent masquerading as 'MicrosoftEdgeUpdateCore.exe' or an injected 'explorer.exe'. The rule correlates these registry access events with the presence of specific Kothamine-related file artifacts (MicrosoftEdgeUpdateCore.dll and tailcat.exe) on the same host within a 24-hour window to minimize noise.
Detects unauthorized access to Windows camera or microphone consent store registry keys by either a suspected Kothamine agent masquerading as 'MicrosoftEdgeUpdateCore.exe' or an injected 'explorer.exe'. The rule correlates these registry access events with the presence of specific Kothamine-related file artifacts (MicrosoftEdgeUpdateCore.dll and tailcat.exe) on the same host within a 24-hour window to minimize noise.
Detects suspicious cross-process memory access events, such as PROCESS_VM_WRITE and PROCESS_SUSPEND_RESUME, often indicative of process hollowing or Early Bird APC injection. The rule monitors for elevated granted access masks originating from non-system processes, a behavior associated with the CLOSEDQUORUM implant's post-compromise activities.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
Detects a sequence of events indicative of LSASS memory dumping where a process opens a handle to lsass.exe and subsequently creates a uniquely named temporary file (16-character hexadecimal filename) in the Windows Temp directory within a short timeframe. This behavior is often associated with the obfuscated flushing of a stolen memory dump to disk to evade signature-based detection.
This rule detects unauthorized attempts to extract credentials from the Local Security Authority Subsystem Service (LSASS) process. It monitors for two distinct techniques: non-standard processes opening handles to lsass.exe with sensitive access rights (credential-dumping) and the use of rundll32.exe to invoke the MiniDump function within comsvcs.dll against lsass.exe.
Page 2 of 32