Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
Detect attempt to enable auditing of TTY input
This rule detects instances where 'WerFaultSecure.exe' is launched by an unusual parent process. 'WerFaultSecure.exe' is a legitimate Windows error reporting tool, but its execution by non-standard parent processes can indicate malicious activity, such as process injection, credential dumping, or defense evasion. The rule assigns a suspicion score based on the parent process and command-line parameters, filtering for medium to critical risk levels. It also extracts the target PID and identifies suspicious parameters or dump types.
This analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, or data exfiltration. It leverages process activity data from Endpoint Detection and Response (EDR) agents, focusing on known attacker tool names. This activity is significant because it serves as an early warning system for potential security incidents, enabling prompt response. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further network compromise, posing a severe threat to the organization's security infrastructure.
Detects scenarios where an attacker dump the LSASS memory content using Mimikatz (sekurlsa module).
Detects scenarios where an attacker will dump the LSASS memory content using tools like Mimikatz, ProcDump, TaskMgr, ...
Detects scenarios where an attacker attempts to dump Group Managed Services account (GMSA) passwords stored on writable domain controllers.
Detects scenarios where an attacker execute Secretdump in order to remotely dump credentials over SMB.
Detects scenarios where an attacker attempts to enable Wdgiest authention so passwords are stored in clear text and can be dumped.
Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.
Detects scenarios where an attacker would dump user passwords using the DCshadow attack.
Detects scenarios where an attacker attempts to create an IFM image (usually used for deploying domain controllers to reduce replication traffic) for dumping credentials.
Detects scenarios where an attacker
Detects scenarios where an attacker attempts to create an IFM image (usually used for deploying domain controllers to reduce replication traffic) for dumping credentials.
Detects scenarios where an attacker attempt to dump LSASS process with tools like Mimikatz.
Detects scenarios where an attacker loaded the Mimikatz SSP "mimilib.dll" into the LSA process in order to exfiltrate clear text passwords into a file.
Detects scenarios where an attacker attempts to enable Wdgiest authention so passwords are stored in clear text and can be dumped.
Provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.
Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.
Provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.
Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.
Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.
Page 15 of 24