Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
This rule detects attempts to perform process injection using the 'ptrace' system call, specifically looking for 'ptrace' and 'PTRACE_ATTACH' within TCP traffic destined for SSH (port 22). This activity is indicative of an attacker trying to attach to a running process, often for debugging, modifying its memory, or injecting malicious code, potentially after gaining remote access via SSH.
Detects DLL injection using LoadLibraryA/W API calls
Detects manipulation of running application data via web shell commands
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which are common targets for credential dumping. It specifically looks for Security Event ID 4656 (A handle to an object was requested) where the ObjectName is either 'lsass.exe' or 'ntds.dit' and the AccessMask indicates read or all access permissions. The rule then summarizes these events by user, computer, and IP address, flagging if two or more such events occur.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
This rule detects repeated access attempts (3 or more within an hour) to critical credential storage processes or files, specifically lsass.exe, the Security Account Manager (SAM) database, or the NTDS.dit file. Such activity is indicative of credential theft attempts by an adversary.
Detects Linux VDSO hijacking for privilege escalation without syscalls
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which are common targets for credential dumping. It specifically looks for Security Event ID 4656 (A handle to an object was requested) where the ObjectName is either 'lsass.exe' or 'ntds.dit' and the AccessMask indicates read or all access permissions. The rule then summarizes these events by user, computer, and IP address, flagging if two or more such events occur.
Detects rundll32.exe or dllhost.exe performing remote thread injection into web browser processes (chrome.exe, msedge.exe, firefox.exe). This activity is often associated with defense evasion and credential theft staging, as observed in campaigns like ClearFake/ClickFix, before a full Remote Access Trojan (RAT) is established.
Detects a process access or memory dumping event indicative of MiniDumpWriteDump against LSASS originating from VSLauncher.exe. This behavior is highly anomalous and has been observed by UAC-0184 via DLL sideloading of the PassMark Endpoint DLL (input.dll) for credential theft.
This rule identifies various indicators of Mimikatz execution, including specific command-line arguments, file names, suspicious access to the LSASS process memory, and the creation or loading of malicious services or DLLs associated with Mimikatz. It aims to detect credential dumping activities and persistence mechanisms often employed by attackers.
Detects Windows Task Manager (taskmgr.exe) requesting access to the Local Security Authority Subsystem Service (LSASS) process to dump memory. This Living-off-the-Land (LotL) technique was utilized by UNC6692 to extract credentials for subsequent pass-the-hash attacks against domain controllers.
Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service.
Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques.
This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.
This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.
Detects a typical pattern of a CobaltStrike BOF which inject into other processes
Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace.
These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll,
dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques.
These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll,
dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques.
Detects non-system users performing privileged operation os the SCM database
Detects WRITE_DAC access to a domain object
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles
Detects the process injection of a LittleCorporal generated Maldoc.
Page 25 of 32