Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
154 detections
Filters
Last updated
All Time
Detection languages
62
37
17
13
9
Contributors
42
28
23
14
10
Categories
97
71
60
44
41
Platforms
153
1
Products / Services
55
46
29
9
8
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
4
3
1
1
Correlates BTR_CLI arbitrary-write invocations (Action 3) targeting System32\drivers with a resulting file write of a known-malicious hash (e.g., mimidrv.sys) or an unsigned/non-Microsoft-signed binary — detecting the kernel write primitive being used to plant a malicious driver into a protected directory.
Detects suspicious Active Directory Replication Service (ADRS) requests originating from
a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.
Under normal operation, only Domain Controllers initiate replication requests carrying the
DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account
credentials — for example by abusing certificate-based authentication (PKINIT) to
impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost),
where a temporary machine account is created to request a DC certificate and then used to
perform DCSync — they can dump all domain credential material including the krbtgt hash.
a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.
Under normal operation, only Domain Controllers initiate replication requests carrying the
DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account
credentials — for example by abusing certificate-based authentication (PKINIT) to
impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost),
where a temporary machine account is created to request a DC certificate and then used to
perform DCSync — they can dump all domain credential material including the krbtgt hash.
Detects process creation events where a process reported as TiWorker.exe (a trusted Windows servicing process) carries a command line containing Invoke-Mimikatz or Mimikatz command modules, indicating the process identity has been spoofed via a Silo-Binding bind-link mapping TiWorker.exe to PowerShell to evade AV/EDR script-blocking controls.
Detects the execution of Mimikatz or the use of specific command-line arguments (e.g., sekurlsa::logonpasswords) known for extracting sensitive credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule monitors both process creation command lines and raw process memory read operations targeted at lsass.exe.
Detects execution of the Mimikatz tool where the 'sekurlsa' module is specified in the command line. This module is commonly used to extract sensitive credential material, such as cleartext passwords and Kerberos tickets, from the LSASS process memory.
Detects the execution of the Mimikatz credential dumping tool, either as the initiating process or the action process, indicating potential credential theft attempts.
This rule detects the execution of the Mimikatz credential dumping tool by monitoring for specific process names or command-line arguments, including the use of 'sekurlsa' modules to harvest credentials from memory. Mimikatz is widely used by adversaries to perform credential theft, including dumping passwords, hashes, and Kerberos tickets from memory.
Detects the execution of known Mimikatz credential dumping commands, specifically 'lsadump::dcsync' used for Active Directory credential extraction, and 'sekurlsa' used for extracting credentials from the LSASS process memory.
Detects the execution of Mimikatz with command line arguments indicative of credential dumping, specifically DCSync attacks or dumping LSASS memory for passwords. The rule filters out processes signed by Microsoft to reduce noise.
This rule detects potentially malicious access to the Local Security Authority Subsystem Service (LSASS) process (lsass.exe). It correlates events where a process requests sensitive access rights (0x1010 or PROCESS_VM_READ) to LSASS with other activities indicating the presence of Mimikatz or related credential dumping tools (e.g., presence of 'mimikatz' or 'sekurlsa' in process names or command lines).
This rule detects command-line arguments and file names associated with the execution of Mimikatz or derived tools (such as SafetyKatz). It monitors for specific modules and flags, including credential harvesting (sekurlsa, lsadump, vault), DPAPI operations, and Kerberos manipulation, which are characteristic of adversary credential theft and privilege escalation activities.
This rule monitors for credential dumping activities by identifying the execution of Mimikatz, the use of command-line arguments specific to Mimikatz (e.g., 'sekurlsa'), or unauthorized processes attempting to access the Local Security Authority Subsystem Service (LSASS) process.
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
Detects execution of Mimikatz or usage of common tools like Procdump to dump LSASS memory. The rule monitors for characteristic command-line arguments, renamed binary names associated with Mimikatz, and the extraction of sensitive credentials to output files.
This rule detects various methods used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to extract credentials. It monitors for suspicious Process Access (EventCode 10) with sensitive access masks, as well as Process Creation (EventCode 1) and Image Load (EventCode 7) events associated with known credential dumping tools like Mimikatz and legitimate system tools misused for dumping memory such as Procdump and comsvcs.dll.
Detects the execution of mimikatz.exe or the usage of the sekurlsa::logonpasswords command, both of which are indicative of attempts to extract sensitive credentials from LSASS memory.
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
The rule detects potential credential dumping activities by monitoring for the execution of Mimikatz or the use of its specific command-line arguments (e.g., sekurlsa::logonpasswords, /ntlm:). It also monitors for suspicious, unauthorized processes attempting to open a handle to the LSASS process to access its memory, a common technique for dumping credentials.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
Detects evidence of credential dumping activities, including the execution of known Mimikatz-related binaries or command lines, unauthorized memory dumping of the LSASS process using tools like procdump or rundll32 with comsvcs.dll, and the presence of known credential dumping artifacts on disk. It also monitors cross-process access to lsass.exe by potentially unauthorized or unsigned processes.
This rule detects known credential dumping activity, specifically focusing on the execution of Mimikatz (or renamed variants) and the use of built-in system tools like comsvcs.dll or procdump to dump lsass.exe process memory.
Page 2 of 8