Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
154 detections
Filters
Last updated
All Time
Detection languages
62
37
17
13
9
Contributors
42
28
23
14
10
Categories
97
71
60
44
41
Platforms
153
1
Products / Services
55
46
29
9
8
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
4
3
1
1
This analytic detects a user account initiating an Active Directory replication request, indicative of a DCSync attack. It leverages EventCode 4662 from the Windows Security Event Log, focusing on specific object types and replication permissions. This activity is significant because it can allow an attacker with sufficient privileges to request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of the entire domain.
Detects the execution of remote access, tunneling, and credential access tools from suspicious directories. This rule specifically targets tools commonly abused by threat actors like Scattered Spider, such as AnyDesk, TeamViewer, ngrok, Teleport, Tailscale, and Mimikatz, when executed from user-writable or temporary folders. It excludes legitimate installations in standard Program Files directories to reduce false positives.
The analytic identifies the execution of the native mimikatz.exe binary on Windows systems, including instances where the binary is renamed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because Mimikatz is a widely used tool for extracting authentication credentials, posing a severe security risk. If confirmed malicious, this activity could allow attackers to obtain sensitive credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and system compromise.
This detection identifies the use of common post-exploitation tools like PsExec, Impacket (specifically WMIExec), and Mimikatz. These tools are frequently used by threat actors for lateral movement and credential access after gaining initial access. The rule looks for specific process names and command-line arguments indicative of these tools.
Detects the execution of PowerShell commandlets commonly associated with well-known PowerShell exploitation frameworks and tools. This rule identifies specific commandlet names within process command lines, indicating potential malicious activity such as credential dumping, reconnaissance, privilege escalation, persistence, and lateral movement.
Detects the creation of known offensive PowerShell scripts used for exploitation, reconnaissance, credential access, persistence, and other malicious activities. The rule identifies specific filenames associated with popular PowerShell offensive security frameworks and tools.
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks. These commandlets perform various adversarial actions such as credential dumping, reconnaissance, persistence, privilege escalation, and data exfiltration.
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
Mimikatz DC Sync
Sigma
Detects Mimikatz DC sync security events
Detects process access requests from hacktool processes based on their default image name
Mimikatz Use
Sigma
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.
'This hunting query will try to identify the user account used to perform a file upload to blob storage.
This query can be used to match all file upload events, or filtering can be applied on filename to search for a specific upload.'
This query can be used to match all file upload events, or filtering can be applied on filename to search for a specific upload.'
' This hunting query looks for process command line activity related to activity observed by Dev-0056.The command lines this query hunts for are used as part of the threat actor's post exploitation activity.
This query uses the Microsoft Sentinel Information Model - https://docs.microsoft.com/azure/sentinel/normalization'
This query uses the Microsoft Sentinel Information Model - https://docs.microsoft.com/azure/sentinel/normalization'
Detects processes requesting access to LSASS memory via suspicious access masks. This is typical for credentials dumping tools
Detects process access requests to the LSASS process with specific call trace calls and access masks.
This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
Detects process access to LSASS which is typical for Mimikatz (0x1000 PROCESS_QUERY_ LIMITED_INFORMATION, 0x0400 PROCESS_QUERY_ INFORMATION "only old versions", 0x0010 PROCESS_VM_READ)
Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference
Detects LSASS process access requests from a source process with the "dump" keyword in its image name.
This query was originally published in the threat analytics report, Msiexec abuse.
Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows installer packages, and are used by a wide array of legitimate software. However, malicious actors can re-purpose msiexec.exe for living-off-the-land attacks, where they use legitimate system binaries on the compromised device to perform attacks.
The following query detects activity associated with misuse of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool.
Reference - https://www.varonis.com/blog/what-is-mimikatz/
Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows installer packages, and are used by a wide array of legitimate software. However, malicious actors can re-purpose msiexec.exe for living-off-the-land attacks, where they use legitimate system binaries on the compromised device to perform attacks.
The following query detects activity associated with misuse of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool.
Reference - https://www.varonis.com/blog/what-is-mimikatz/
Page 5 of 8