Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
Detects reading of process memory via /proc filesystem for credential extraction
Hunting rule for "Dump Credential Manager using keymgr.dll and rundll32.exe" (OS Credential Dumping) using command-line and process indicators derived from executor behavior.
Detects suspicious command-line activity involving utilities that contain 'checksum' or 'hash' in their command line, potentially indicating file integrity checks, malware analysis evasion, or credential dumping attempts. The rule triggers if five or more such commands are executed within an hour by the same account on the same computer.
This rule detects the execution of processes where the command line contains keywords commonly associated with credential dumping activities, specifically targeting NTUser.dat, SAM, or SYSTEM files. These files often contain sensitive credential information that attackers attempt to extract.
Detects enabling of reversible password encryption in Active Directory
Identifies `grep` or `findstr` utilizing decoded regex patterns searching for cloud environment variables locally, specifically looking for patterns like AKIA (AWS Access Key ID), xoxb (Slack Bot User OAuth Token), ghp_ (GitHub Personal Access Token), or npm_ (NPM Access Token). This activity is then correlated with network connections to a specific IP address (216.126.225.129), which is associated with the Megalodon CI/CD malware.
This rule detects multiple attempts (3 or more within an hour) to access critical registry hives (SAM, SYSTEM, SECURITY) with specific access masks (0x0001 - ReadData/ListDirectory or 0x0002 - WriteData/AddFile). This activity can be indicative of credential dumping attempts, particularly targeting the SAM hive to extract local user credentials.
This rule detects multiple attempts (3 or more within an hour) to access critical registry hives (SAM, SYSTEM, SECURITY) with specific access masks (0x0001 - ReadData/ListDirectory or 0x0002 - WriteData/AddFile). This activity can be indicative of credential dumping attempts, particularly targeting the SAM hive to extract local user credentials.
This rule detects the execution of processes with command-line arguments indicative of credential theft tools such as Mimikatz, lsadump, sekurlsa, vault, cachedump, or hashdump. It specifically looks for these keywords within Security Event ID 4688 (a process creation event) logs.
Identifies inbound remote RPC calls targeting the Remote Registry interface to save registry keys (OpNums 20 and 31). This is frequently abused for remote credential dumping of SAM/LSA secrets.
Detects the use of the GNU Debugger (gdb) to dump process memory (gcore) to disk, a technique abused by attackers to extract credentials residing in Runner.Worker. The rule specifically looks for process creation events where 'gdb' is in the command line along with process ID flags ('-p' or '--pid') and memory dumping commands ('dump memory' or 'gcore').
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
Hunting rule for Atomic Red Team T1003 test "Send NTLM Hash with RPC Test Connection" (OS Credential Dumping) using command-line and process indicators derived from executor behavior.
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
Detects suspicious command-line activity involving utilities that contain 'checksum' or 'hash' in their command line, potentially indicating file integrity checks, malware analysis evasion, or credential dumping attempts. The rule triggers if five or more such commands are executed within an hour by the same account on the same computer.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which are common targets for credential dumping. It specifically looks for Security Event ID 4656 (A handle to an object was requested) where the ObjectName is either 'lsass.exe' or 'ntds.dit' and the AccessMask indicates read or all access permissions. The rule then summarizes these events by user, computer, and IP address, flagging if two or more such events occur.
Detects processes attempting to scrape unmasked CI runner secrets from memory or using specific grep patterns associated with the Miasma worm. The worm escalates privileges to read Runner.Worker memory directly, bypassing standard GitHub Actions secret masking.
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
This rule detects repeated access attempts (3 or more within an hour) to critical credential storage processes or files, specifically lsass.exe, the Security Account Manager (SAM) database, or the NTDS.dit file. Such activity is indicative of credential theft attempts by an adversary.
Page 11 of 24