Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects potential calls to NtOpenProcess directly from NTDLL.
Detects process access requests from known hacktool processes based on their executable names. This rule targets a wide range of tools commonly used for credential dumping, privilege escalation, and other malicious activities, including Mimikatz, various Potato exploits, and other offensive security tools. The detection focuses on the 'SourceImage' field, indicating the process initiating the access.
Detects suspicious process access requests to the LSASS process using specific GrantedAccess flags. These flags are often associated with tools and techniques used for credential dumping, such as Mimikatz, by attempting to read or manipulate LSASS memory to extract credentials. The rule includes filters for common legitimate processes like antivirus software, EDRs, and system utilities to reduce false positives.
Detects process access requests from hacktool processes based on their default image name
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory with specific access rights (0x705) and an object type of 'SAM_DOMAIN'. This activity is indicative of tools or techniques used to dump credentials from LSASS, a common method for adversaries to obtain user credentials.
Detects potential shellcode injection attempts by monitoring process access events where a process requests specific access rights (0x147a or 0x1f3fff) and the call trace contains 'UNKNOWN'. This behavior is characteristic of tools like Metasploit's migrate and Empire's psinject, which inject shellcode into other processes. The rule includes filters to reduce false positives from legitimate system processes like Wmiprvse.exe accessing Lsass.exe, Dell software interactions, and Microsoft Visual Studio processes.
This rule detects remote access to the Local Security Authority Subsystem Service (LSASS) process via Windows Remote Management (WinRM). This activity is highly indicative of credential dumping attempts, often performed by tools like Mimikatz, to extract sensitive authentication material from memory. The rule specifically looks for process access events where the target process is 'lsass.exe' and the source process initiating the access is 'wsmprovhost.exe', which is associated with WinRM. It also filters out common benign access patterns (0x80000000 GrantedAccess) to reduce false positives.
Detects a typical pattern of a Cobalt Strike Beacon Object File (BOF) attempting to inject into other processes. This rule specifically looks for process access events where the call trace indicates a sequence from ntdll.dll to KERNELBASE.dll, followed by an unknown module, combined with specific granted access rights (0x1028 or 0x1fffff). This pattern is indicative of certain process injection techniques used by Cobalt Strike BOFs.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory with specific uncommon access flags (0x410 and 0x01410). These flags are often used by tools or techniques designed to dump credentials from LSASS, a common method for credential theft on Windows systems. The rule includes extensive filters to reduce false positives from legitimate software that might interact with LSASS.
Detects a PowerShell process attempting to access the Local Security Authority Subsystem Service (LSASS) process memory. This activity is a strong indicator of potential credential dumping attempts, where an attacker tries to extract sensitive authentication material (like passwords or hashes) from memory.
This rule detects PowerShell scripts attempting to use specific Windows API functions that are commonly associated with malicious activities such as process injection (VirtualAlloc, OpenProcess, WriteProcessMemory, CreateRemoteThread), token manipulation (OpenProcessToken, LookupPrivilegeValue, AdjustTokenPrivileges, DuplicateTokenEx), and memory operations (ReadProcessMemory, VirtualFree). Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory from non-system accounts, which is a common technique used by credential dumping tools like Mimikatz. The rule specifically looks for security events (4663 or 4656) related to process object access with specific access masks targeting 'lsass.exe', while filtering out legitimate system accounts and known benign processes.
Detects access to the LSASS process by a Python-based tool, indicated by specific call trace patterns involving Python DLLs and KERNELBASE.dll/ntdll.dll, combined with a broad granted access right (0x1FFFFF). This activity is characteristic of credential dumping tools like LaZagne or Pypykatz.
Detects process access to 'verclsid.exe' that involves injecting shellcode, originating from a Microsoft Office application or VBA macro. This behavior is indicative of malicious activity, potentially leveraging 'verclsid.exe' for defense evasion and privilege escalation.
Detects attempts to access the LSASS process memory by tools or processes that have the keyword "dump" in their image name. This behavior is indicative of credential dumping activities, where adversaries try to extract sensitive information like passwords and hashes from the LSASS process.
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass. This technique is often used to extract credentials.
Detects attempts to dump LSASS process memory using WerFault.exe. This technique is often used by tools like Mimikatz, NanoDump, Invoke-Mimikatz, Procdump, or Taskmgr to extract credentials from the Local Security Authority Subsystem Service (LSASS) process. The rule specifically looks for WerFault.exe accessing lsass.exe with a GrantedAccess of '0x1FFFFF', which indicates full access.
This rule detects a User Account Control (UAC) bypass technique that leverages a WoW64 logger DLL hijack, specifically referencing UACMe method 30. It identifies process access events where the source image is located in 'C:\Windows\SysWOW64\', requests full access ('0x1fffff'), and exhibits an unknown call trace pattern starting with 'UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|'. This combination of indicators suggests an attempt to elevate privileges by injecting a malicious DLL into a trusted process.
Detects a possible process memory dump of lsass.exe using a renamed or masqueraded executable named 'TrolleyExpress.exe'. This technique leverages the whitelisted nature of the legitimate Citrix TrolleyExpress.exe to evade detection while attempting to dump LSASS memory, often indicated by command-line arguments targeting process IDs in the 700-999 range or the '-ma' flag for memory dumping.
Detects suspicious access to the Local Security Authority Subsystem Service (LSASS) process memory. This rule specifically looks for access to 'lsass.exe' originating from 'svchost.exe' with a specific suspicious access right ('0x14c0') and a call trace indicating 'seclogon.dll'. This combination suggests an attempt to dump LSASS memory, potentially to steal credentials.
Detects a possible process memory dump of LSASS using processes with whitelisted filenames (like TrolleyExpress.exe, ProcessDump.exe, dump64.exe) to evade detection by security products like Microsoft Defender. The rule specifically looks for access to lsass.exe with granted access rights commonly associated with memory dumping.
Page 31 of 32