Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
This rule detects the presence of MicroStealer malware by matching known MD5, SHA1, or SHA256 hashes of its binaries against file events on monitored devices. MicroStealer is a credential stealer that targets various applications to exfiltrate sensitive information.
This rule detects the presence of files on endpoints that match a list of known malicious SHA256 hashes associated with the Nuso malware. It queries DeviceFileEvents to identify any file with a matching hash.
Detects the invocation of the Windows Credential Manager interface via rundll32.exe loading keymgr.dll with the KRShowKeyMgr export. This technique is used to view or dump stored credentials and is known to be employed by the Warlock ransomware group during post-exploitation lateral movement.
Detects creation or presence of NTDS.dit and SYSTEM hive files in a user desktop context, consistent with reported domain controller disk mount and offline credential dumping activity.
Detects access to VMware virtual disk files (.vmdk). This technique was
observed being used by the Muddled Libra (Scattered Spider) threat group,
where they would power down Domain Controllers, mount their disks to a rogue
VM, and steal the NTDS.dit and SYSTEM hives for offline credential extraction.
This method bypasses security monitoring that would typically occur on the
Domain Controller itself.
observed being used by the Muddled Libra (Scattered Spider) threat group,
where they would power down Domain Controllers, mount their disks to a rogue
VM, and steal the NTDS.dit and SYSTEM hives for offline credential extraction.
This method bypasses security monitoring that would typically occur on the
Domain Controller itself.
Identity LOLBA trying to dump AD server credentials and security information´s
Detects privileged credential retrieval from Privileged Access Management (PAM) solutions via PowerShell, including CyberArk AIM, Thycotic, HashiCorp Vault
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
This rule detects the presence or execution of known malicious infostealer files based on their SHA256 hash values or a specific filename pattern. The SHA256 hashes are associated with infostealer malware as referenced in a VirusTotal blog post. The filename pattern 'malwarebytes-windows-github-io' also indicates potential malicious activity, likely related to a deceptive download or execution.
Detects the execution of Mimikatz for credential dumping shortly after the WDigest 'UseLogonCredential' registry key is enabled. This combination of TTPs is associated with the Qilin ransomware group.
Detects suspicious process access to common credential storage locations such as certificate stores, PCPKSP keys, and CloudAPCache for AzureAD credentials. The severity of the alert is escalated based on the initiating process and command line arguments, specifically looking for keywords like 'mimikatz', 'dump', or 'export'.
Detects scenarios where a security policy is exported to a .cfg file using secedit.exe and subsequently accessed/reviewed using notepad.exe on the same Windows host. This activity may indicate reconnaissance or staging for privilege escalation or lateral movement by a threat actor.
Mimikatz payload has been executed on a system as one-liner likely to output to a file for collection
This rule is to identify when the registry key (SYSTEM\CurrentControlSet\Control\SecurityProviders\ WDigest\UseLogonCredential OR SYSTEM\ControlSet00*\Control\SecurityProviders\ WDigest\UseLogonCredential) is modified signaling a possible WDigest downgrade attack, which was recently seen and attributed to the SmokedHam tool from UNC2465 and its affiliates.
A composite detection rule that identifies multiple techniques, tactics, and procedures (TTPs) associated with the RansomHub intrusion detailed in "The DFIR Report". This rule focuses on process creation events and flags the execution of specific credential dumping tools, network scanners, defense evasion commands, ransomware behaviors, and exfiltration tool chains. An alert from this rule indicates a high probability of malicious activity consistent with this threat actor's methodology.
Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
NTDS theft
KQL
Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.
Detects suspicious process creation activities executed by the SYSTEM user, specifically looking for known malicious programs or command-line parameters often associated with credential dumping, defense evasion, and privilege escalation techniques. This includes the use of tools like Mimikatz, Rubeus, ProcDump, and various PowerShell obfuscation methods, as well as commands related to shadow copy deletion and registry hive saving.
Detects the modification of the WDigest registry key to enable plaintext credential caching. This technique is used by threat actors like the Qilin ransomware group to harvest credentials from memory using tools like Mimikatz.
Detects the execution of TruffleHog, an open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. This activity can indicate credential harvesting by threat actors. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
Detects suspicious process execution patterns originating from AsperaFaspex, specifically targeting activities observed in campaigns attributed to Mint Sandstorm. The rule looks for PowerShell execution with suspicious command-line arguments (e.g., for credential dumping, defense evasion, or discovery), execution of tools like wget or curl for downloading content, attempts to modify local administrator groups, registry modifications for defense evasion, and WMI/vssadmin/wbadmin commands for persistence or defense evasion. This behavior indicates potential post-exploitation activity.
Page 13 of 24