Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
Detects processes attempting to scrape unmasked CI runner secrets from memory, specifically looking for techniques used by the Miasma worm to bypass GitHub Actions secret masking. This rule identifies suspicious command-line patterns indicative of secret extraction, such as searching for 'isSecret' or accessing '/proc/mem' with Python.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which are common targets for credential dumping. It specifically looks for Security Event ID 4656 (A handle to an object was requested) where the ObjectName is either 'lsass.exe' or 'ntds.dit' and the AccessMask indicates read or all access permissions. The rule then summarizes these events by user, computer, and IP address, flagging if two or more such events occur.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
This rule detects attempts to search for sensitive keywords like 'password', 'secret', 'credential', 'creds', 'apikey', 'token', or 'key' using 'findstr.exe' or 'reg.exe'. This activity can indicate an adversary attempting to discover credentials or other sensitive information on a compromised system.
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
Remote LSASS Memory Dump via SMB
Suricata
This rule detects attempts to remotely dump the LSASS process memory over SMB. It specifically looks for the string "lsass.exe" within TCP traffic destined for port 445 (SMB) on the home network. This activity is indicative of an attacker trying to extract credentials from a compromised system.
Identifies node.js or npm processes attempting to access known credential stores or execute credential dumping utilities, which may indicate the presence of the Miasma credential-stealing worm.
Identifies node.js or npm processes attempting to access known credential stores or execute credential dumping utilities, which may indicate the presence of the Miasma credential-stealing worm.
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
Detects Python processes attempting to read process memory (/proc/*/mem) or using a specific shell pipeline to scrape GitHub Actions Runner memory for masked secrets, as observed in the Mini Shai-Hulud supply chain attack.
Detects access to sensitive files, credential data, or remote procedure call (RPC) endpoints related to credential dumping over a network share.
This could indicate lateral movement or remote credential harvesting techniques.
This could indicate lateral movement or remote credential harvesting techniques.
Detects a Python process attempting to access the memory of another process via the /proc filesystem. This behavior was observed in the Shai-Hulud SAP CAP supply chain attack, where a Python script dumped the Runner.Worker process memory to extract short-lived, high-value tokens passed between CI workflow steps.
This rule detects multiple TTPs (Tactics, Techniques, and Procedures) associated with advanced adversaries, including QEMU virtualization abuse for defense evasion, creation of malicious scheduled tasks (specifically 'TPMProfiler'), rogue account or service creation (e.g., 'CtxAppVCOMService' or 'AppMgmt' service via 'sc.exe'), port forwarding/tunneling commands (using 'ssh' or 'portproxy' with specific ports), credential access attempts via 'vssuirun.exe' or printing 'NTDS.dit', and potential DLL sideloading involving 'ADNotificationManager.exe' and 'vcruntime140_1.dll'. It also includes IOCs for specific IPs, domains, and file hashes.
This rule detects suspicious execution patterns of rundll32.exe. Specifically, it looks for rundll32.exe being called with an obfuscated ordinal number (e.g., #+, #-, #0, #655, #656) which can be used by adversaries to obscure malicious code. Additionally, it identifies rundll32.exe attempting to perform a MiniDump of the 'comsvcs' process, which is a common technique for OS credential dumping.
this query combines Queries in a single Query created from Ayush Anand and published on https://www.securityinbits.com/detection-engineering/lsass-dump-comsvcs-rundll32/
this query combines Queries in a single Query created from Ayush Anand and published on https://www.securityinbits.com/detection-engineering/lsass-dump-comsvcs-rundll32/
Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.
These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.
These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Detects attempts to read raw disk data using mknod or dd, a technique observed in malicious npm packages to bypass permissions and extract secrets.
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
Detects the creation or execution of 'filemanager.exe' in the user's Downloads folder. DeepLoad uses WMI subscriptions that survive standard cleanup to drop this specific credential stealer into the Downloads folder three days after initial infection.
Detects a Python process attempting to read the memory (`/proc/<pid>/mem` or `/maps`) of a GitHub Actions `Runner.Worker` process. This is indicative of the credential dumping technique used by the TeamPCP threat actor during the Trivy supply chain compromise to extract highly privileged injected secrets.
Page 12 of 24