Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
2
1
1
Categories
3
2
1
1
1
Platforms
2
1
1
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects suspicious attempts to access macOS Keychain or browser credentials (Chrome, Firefox) using 'osascript' or 'security' command-line utilities. This rule identifies patterns indicative of credential dumping or access, such as unlocking keychains, finding generic passwords, or accessing browser-specific credential files.
KQL Query
KQL Query
This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.
DoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. For example, they use SysInternal utilities such as ProcDump to dump credentials from LSASS. They often use these stolen credentials to turn off security software, run malicious commands, and spread malware throughout an organization.
The following query detects ProcDump being used to dump credentials from LSASS.
The See also section below lists links to other queries associated with DoppelPaymer.
References:
https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoppelPaymer!MTB&threatId=-2147205372
https://docs.microsoft.com/sysinternals/downloads/procdump
https://docs.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
DoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. For example, they use SysInternal utilities such as ProcDump to dump credentials from LSASS. They often use these stolen credentials to turn off security software, run malicious commands, and spread malware throughout an organization.
The following query detects ProcDump being used to dump credentials from LSASS.
The See also section below lists links to other queries associated with DoppelPaymer.
References:
https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoppelPaymer!MTB&threatId=-2147205372
https://docs.microsoft.com/sysinternals/downloads/procdump
https://docs.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
