Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects suspicious access to the "svchost" process with a high level of granted access (0x1F3FFF) and an unknown call trace. This behavior is often associated with techniques like those used by Invoke-Phantom to terminate critical system processes, such as the Windows event logging service, to evade detection. The rule filters out legitimate MSBuild activity that might exhibit similar call trace characteristics.
Detects process access events where the call trace contains 'cmlua.dll', which is indicative of Microsoft Connection Manager Profile Installer (CMSTP) execution. This activity can be abused by adversaries for code execution and UAC bypass.
Detects function calls from the EditionUpgradeManager COM interface, which is not typically used by standard executables. This activity can be indicative of a User Account Control (UAC) bypass attempt.
Detects read access to a domain user from a non-machine account
Detects non-system users failing to get a handle of the SCM database.
Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.
Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN
Detects Access to LSASS Process
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.
Detects LSASS process access requests from a source process with the "dump" keyword in its image name.
Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.
Page 32 of 32