Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
23
2
1
Contributors
14
9
1
1
1
Categories
8
8
7
4
4
Platforms
26
1
Products / Services
9
7
3
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects password dumper activity by monitoring remote thread creation (EventID 8) where the target process is 'lsass.exe'. The process initiating the remote thread is the malicious program. A single execution of such a tool can generate numerous events.
Detects well-known credential dumping tools execution via service execution events
Detects well-known credential dumping tools execution via service execution events
Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage.
The process in field Process is the malicious program. A single execution can lead to hundreds of events.
The process in field Process is the malicious program. A single execution can lead to hundreds of events.
Detects the use of Windows Credential Editor (WCE)
Page 2 of 2