Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behavior is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory by other processes. Specifically, it triggers when a process attempts to open lsass.exe and the accessing process's image name (full path) contains the keyword "dump". This behavior is indicative of tools used for credential dumping, such as Mimikatz or similar utilities, which often include "dump" in their filenames or paths.
This rule detects attempts by known hacktool processes to access other processes. It specifically looks for 'PROCESS_OPEN' events where the principal process's image name matches a predefined list of hacktool patterns. This behavior is often indicative of credential dumping or other malicious activities where a tool needs to interact with another process's memory space, such as LSASS.
This rule detects attempts to interact with Sysmon processes (Sysmon.exe or Sysmon64.exe) with specific access rights (0x1400), which is indicative of the SysmonEnte tool. It also directly looks for the string 'Ente' in the CallTrace, which is a unique identifier for SysmonEnte's activity. The rule filters out legitimate access from common program file locations and Microsoft Defender to reduce false positives.
Detects the creation of a remote thread in sensitive processes indicative of code injection techniques, such as APC or thread injection.
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up
Detects process access requests from hacktool processes based on their default image name
Detects LSASS process access requests from a source process with the dump keyword in its image name
The following analytic detects a process accessing the winlogon.exe system process, indicative of the Rubeus tool attempting to export Kerberos tickets from memory. This detection leverages Sysmon EventCode 10 logs, focusing on processes obtaining a handle to winlogon.exe with specific access rights. This activity is significant as it often precedes pass-the-ticket attacks, where adversaries use stolen Kerberos tickets to move laterally within an environment. If confirmed malicious, this could allow attackers to bypass normal access controls, escalate privileges, and persist within the network, posing a severe security risk.
This analytic detects potential credential dumping by identifying specific GrantedAccess permission requests and CallTrace DLLs targeting the LSASS process. It leverages Sysmon EventCode 10 logs, focusing on access requests to lsass.exe and call traces involving debug and native API DLLs like dbgcore.dll, dbghelp.dll, and ntdll.dll. This activity is significant as credential dumping can lead to unauthorized access to sensitive credentials. If confirmed malicious, attackers could gain elevated privileges and persist within the environment, posing a severe security risk.
The following analytic detects suspicious process access by spoolsv.exe, potentially indicating exploitation of the PrintNightmare vulnerability (CVE-2021-34527). It leverages Sysmon EventCode 10 to identify when spoolsv.exe accesses critical system files or processes like rundll32.exe with elevated privileges. This activity is significant as it may signal an attempt to gain unauthorized privilege escalation on a vulnerable machine. If confirmed malicious, an attacker could achieve elevated privileges, leading to further system compromise, persistent access, or unauthorized control over the affected environment.
The analytic detects potential WMI token impersonation activities where `wmiprvse.exe` obtains duplicate or full granted access to another process. This behavior is commonly observed in malware, such as Qakbot, for privilege escalation and defense evasion. Successful exploitation could lead to elevated privileges and persistence within the environment.
The analytic detects a process attempting to access winlogon.exe to duplicate its handle. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights (0x1040). This activity is significant because it is a common technique used by adversaries to escalate privileges by leveraging the high privileges and security tokens associated with winlogon.exe. If confirmed malicious, this could allow an attacker to gain elevated privileges, potentially leading to full system compromise and unauthorized access to sensitive information.
This analytic detects a suspicious process attempting to terminate the Lsass.exe process. It leverages Sysmon EventCode 10 logs to identify processes granted PROCESS_TERMINATE access to Lsass.exe. This activity is significant because Lsass.exe is a critical process responsible for enforcing security policies and handling user credentials. If confirmed malicious, this behavior could indicate an attempt to perform credential dumping, privilege escalation, or evasion of security policies, potentially leading to unauthorized access and persistence within the environment.
Detects HandleKatz, a tool designed to duplicate the LSASS process handle with specific access rights (PROCESS_DUP_HANDLE, PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_QUERY_INFORMATION) to later dump its memory without opening new handles. The detection logic focuses on the target image being 'lsass.exe', the specific granted access rights, and a suspicious call trace originating from ntdll.dll with an 'UNKNOWN' module.
This rule detects attempts to gain 'PROCESS_ALL_ACCESS' rights to specific, commonly used Windows processes such as 'calc.exe', 'notepad.exe', and 'mspaint.exe'. Granting 'PROCESS_ALL_ACCESS' provides the requesting process with all possible access rights to the target process, which can be abused by malicious software for process injection, privilege escalation, or defense evasion.
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behavior is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process with suspicious access masks. Adversaries often target LSASS to dump credentials for lateral movement or privilege escalation. The rule looks for specific access mask values in Windows Security Event IDs 4656 (handle requested) and 4663 (object access attempt) that are indicative of credential dumping activities, while filtering out known legitimate processes.
This rule detects potential direct system calls to NtOpenProcess, specifically when the CallTrace starts with 'UNKNOWN'. This behavior can be indicative of advanced persistent threats (APTs) or malware attempting to evade detection by bypassing user-mode API hooks. The rule includes several filters to reduce false positives from legitimate applications and system processes.
Page 30 of 32