Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
154 detections
Filters
Last updated
All Time
Detection languages
62
37
17
13
9
Contributors
42
28
23
14
10
Categories
97
71
60
44
41
Platforms
153
1
Products / Services
55
46
29
9
8
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
4
3
1
1
Detects the execution of Rubeus or Mimikatz with command-line arguments indicative of Kerberos attacks such as Pass the Ticket (PtT) or Golden Ticket generation. This rule specifically looks for keywords like 'rubeus ptt', 'kerberos::ptt', 'kerberos::golden', and 'mimikatz kerberos' in process command lines.
Detects process access requests to the LSASS process with specific call trace calls and access masks.
This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
This rule detects the execution of Mimikatz via process name matching or the presence of known credential dumping command-line arguments (e.g., 'sekurlsa::logonpasswords' or 'privilege::debug'). These indicators are commonly used by adversaries to extract sensitive information like plaintext passwords or hashes from the LSASS memory process.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
The rule detects potential credential dumping activities by monitoring for the execution of Mimikatz or the use of its specific command-line arguments (e.g., sekurlsa::logonpasswords, /ntlm:). It also monitors for suspicious, unauthorized processes attempting to open a handle to the LSASS process to access its memory, a common technique for dumping credentials.
Detects the execution of processes with command-line arguments characteristic of the Mimikatz tool, specifically the 'sekurlsa', 'lsadump', and 'privilege::debug' modules used for credential dumping and process debugging.
Detects the use of Mimikatz to perform a DCSync attack, which allows an adversary to simulate the replication process from a domain controller to extract sensitive password hashes from Active Directory.
Detects the execution of the Mimikatz tool or the usage of specific command-line arguments associated with common credential dumping and persistence techniques, such as Skeleton Key or LSASS patching.
Detects the execution of the Mimikatz tool or the usage of specific command-line arguments associated with common credential dumping and persistence techniques, such as Skeleton Key or LSASS patching.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
This rule detects attempts to dump LSASS process memory using common tools like procdump, rundll32 with comsvcs.dll, or mimikatz (sekurlsa module), followed by DCOM lateral movement (network connection on port 135) on the same device within a 30-minute window. This sequence of events is indicative of an adversary attempting to steal credentials and then use them for lateral movement within the network.
Detects execution of Mimikatz or the use of specific Mimikatz command-line arguments (e.g., 'sekurlsa::logonpasswords', 'privilege::debug') indicative of credential dumping, a common technique for harvesting plaintext credentials or hashes from LSASS memory.
Detects various methods and tools commonly used by adversaries for credential dumping, including process memory dumping of lsass.exe via procdump or comsvcs.dll, and the execution of credential dumping tools like Impacket's secretsdump, ntlmrelayx, or Mimikatz.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
Detects the execution of processes with command-line arguments characteristic of the Mimikatz tool, specifically the 'sekurlsa', 'lsadump', and 'privilege::debug' modules used for credential dumping and process debugging.
Detects the use of Mimikatz to perform a DCSync attack, which allows an adversary to simulate the replication process from a domain controller to extract sensitive password hashes from Active Directory.
Detects Pass-the-Ticket attacks using stolen Kerberos tickets
Detects common credential dumping techniques targeting the LSASS process memory, including the execution of Mimikatz, use of 'sekurlsa::logonpasswords', and memory dumps using comsvcs.dll or procdump.
Detects the execution of known credential extraction tools such as Mimikatz, LaZagne, Hashcat, or John the Ripper, indicated by specific keywords in the command line arguments. This rule monitors for process creation events (EventID 4688) where these tools are used in conjunction with keywords related to passwords, hashes, or credentials.
Detects the execution of known credential extraction tools such as Mimikatz, LaZagne, Hashcat, or John the Ripper, indicated by specific keywords in the command line arguments. This rule monitors for process creation events (EventID 4688) where these tools are used in conjunction with keywords related to passwords, hashes, or credentials.
This rule detects the execution of processes with command-line arguments indicative of credential theft tools such as Mimikatz, lsadump, sekurlsa, vault, cachedump, or hashdump. It specifically looks for these keywords within Security Event ID 4688 (a process creation event) logs.
Page 3 of 8