Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
154 detections
Filters
Last updated
All Time
Detection languages
62
37
17
13
9
Contributors
42
28
23
14
10
Categories
97
71
60
44
41
Platforms
153
1
Products / Services
55
46
29
9
8
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
4
3
1
1
This rule detects the execution of processes with command-line arguments indicative of credential theft tools such as Mimikatz, lsadump, sekurlsa, vault, cachedump, or hashdump. It specifically looks for these keywords within Security Event ID 4688 (a process creation event) logs.
Detects download of known offensive security and post-exploitation tools
The rule detects the use of Mimikatz by searching for specific keywords within Windows event logs. These keywords include Mimikatz module commands (e.g., 'dpapi::masterkey', 'kerberos::golden', 'lsadump::', 'sekurlsa::'), artifacts associated with Mimikatz (e.g., 'mimidrv.sys', 'mimilib.dll'), and PowerShell commands commonly used with Mimikatz (e.g., 'Invoke-Mimikatz', 'Invoke-Mimikittenz'). The detection logic specifically excludes events with EventID 15.
Detects attempts to dump LSASS memory for credential extraction
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
This rule detects explicit references to popular PowerShell credential dumping tools, specifically 'Invoke-Mimikatz' and 'Invoke-Kerberoast', within executed PowerShell commands. It leverages native Defender XDR PowerShell command logging to identify these suspicious activities, which are indicative of credential access attempts.
Detects download of known offensive security tools for capability acquisition
This rule detects the execution of known credential dumping tools, Mimikatz and ProcDump, when specific command-line arguments associated with credential extraction from LSASS are used. It specifically looks for `mimikatz.exe` or `procdump.exe` combined with arguments like `sekurlsa`, `logonpasswords`, or `-ma` which are commonly used to dump credentials from memory.
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
This rule detects the execution of known credential dumping tools, Mimikatz and ProcDump, when specific command-line arguments associated with credential extraction from LSASS are used. It specifically looks for `mimikatz.exe` or `procdump.exe` combined with arguments like `sekurlsa`, `logonpasswords`, or `-ma` which are commonly used to dump credentials from memory.
This rule identifies various indicators of Mimikatz execution, including specific command-line arguments, file names, suspicious access to the LSASS process memory, and the creation or loading of malicious services or DLLs associated with Mimikatz. It aims to detect credential dumping activities and persistence mechanisms often employed by attackers.
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.
This rule detects the execution of Mimikatz or Mimikatz-related tools and scripts (e.g., DumpCreds, Invoke-Mimikatz, Invoke-Mimikittenz) by analyzing command-line arguments. It specifically looks for the use of various Mimikatz modules and commands, including those related to credential dumping (e.g., sekurlsa::logonpasswords, lsadump::sam, dpapi::masterkey), privilege escalation (e.g., privilege::debug, token::elevate), and other functionalities like Kerberos ticket manipulation (e.g., kerberos::golden, kerberos::ptt).
Detects the execution of Mimikatz for credential dumping shortly after the WDigest 'UseLogonCredential' registry key is enabled. This combination of TTPs is associated with the Qilin ransomware group.
Detects suspicious process creation activities executed by the SYSTEM user, specifically looking for known malicious programs or command-line parameters often associated with credential dumping, defense evasion, and privilege escalation techniques. This includes the use of tools like Mimikatz, Rubeus, ProcDump, and various PowerShell obfuscation methods, as well as commands related to shadow copy deletion and registry hive saving.
Detects the modification of the WDigest registry key to enable plaintext credential caching. This technique is used by threat actors like the Qilin ransomware group to harvest credentials from memory using tools like Mimikatz.
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior, often associated with tools like Mimikatz's sekurlsa::pth module. This indicates an adversary is using stolen password hashes to authenticate to a system.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
The analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities such as Pass the Ticket, Pass the Hash, and credential dumping. This activity is significant as Mimikatz is a well-known tool used for credential theft and lateral movement. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
This analytic detects the extraction of authentication certificates using Windows Event Log - CAPI2 (CryptoAPI 2). It specifically leverages EventID 70, which is generated when a certificate's private key is acquired. This detection is significant because it can identify potential misuse of certificates, such as those extracted by tools like Mimikatz or Cobalt Strike. If confirmed malicious, this activity could allow attackers to impersonate users, escalate privileges, or access sensitive information, posing a severe risk to the organization's security.
The following analytic identifies processes attempting to access Lsass.exe, which may indicate credential dumping or applications needing credential access. It leverages Sysmon EventCode 10 to detect such activities by analyzing fields like TargetImage, GrantedAccess, and SourceImage. This behavior is significant as unauthorized access to Lsass.exe can lead to credential theft, posing a severe security risk. If confirmed malicious, attackers could gain access to sensitive credentials, potentially leading to privilege escalation and further compromise of the environment.
Page 4 of 8