Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects process access to LSASS which is typical for Mimikatz (0x1000 PROCESS_QUERY_ LIMITED_INFORMATION, 0x0400 PROCESS_QUERY_ INFORMATION "only old versions", 0x0010 PROCESS_VM_READ)
Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference
Detects LSASS process access requests from a source process with the "dump" keyword in its image name.
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles
Detects a PowerShell process requesting access to "lsass.exe", which can be indicative of potential credential dumping attempts
This query looks for signs of credential dumping based on process activity instead of targeting process names.
Author: Jouni Mikkola
More info: https://threathunt.blog/lsass-credential-dumping/
Author: Jouni Mikkola
More info: https://threathunt.blog/lsass-credential-dumping/
Detects potential NT API stub patching as seen used by the project PatchingAPI
Detects potential calls to NtOpenProcess directly from NTDLL.
Detects process access requests to LSASS process with potentially suspicious access flags
Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)
Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.
Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon
Detects the process injection of a LittleCorporal generated Maldoc.
Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.
Detects process access to LSASS memory with suspicious access flags and from a potentially suspicious folder
Detects process access to LSASS memory with uncommon access flags 0x410 and 0x01410
Detects suspicious process access to the Local Security Authority Subsystem Service (LSASS) memory. The rule specifically looks for processes attempting to access LSASS with certain access flags from potentially suspicious folders like temporary directories or user application data folders. This behavior is indicative of credential dumping attempts, often performed by malware or attackers to harvest credentials.
This rule detects attempts to dump credentials from the Local Security Authority Subsystem Service (LSASS) process using `WerFault.exe`. It specifically looks for `WerFault.exe` accessing `lsass.exe` with a specific access mask (`0x1FFFFF`), which is indicative of memory dumping tools like Mimikatz, NanoDump, Invoke-Mimikatz, Procdump, or Taskmgr. This technique is often used by adversaries to extract credentials for lateral movement or persistence.
This rule detects attempts to dump the Local Security Authority Subsystem Service (LSASS) memory using `rundll32.exe` to call the `MiniDump` export function from `comsvcs.dll`. This technique is commonly used by adversaries to extract credentials from a compromised system.
Page 29 of 32