Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.
Detects scenarios where an attacker attempts to forge a special Kerberos service ticket in order to extract credentials from Read Only Domain Controllers (RODC).
This rule detects the use of 'Rpcping.exe' to force NTLM authentication by sending an RPC test connection to a target server. This technique can be used by attackers to capture NTLM hashes, which can then be cracked offline to obtain user credentials.
Detects the enumeration of loaded modules or DLLs within processes using 'tasklist.exe' with the '-m' flag. This activity is often performed by attackers to identify the Process ID (PID) associated with a specific DLL (e.g., 'rdpcorets.dll') for subsequent actions like dumping process memory to extract credentials.
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe".
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.
This detection identifies a sequence of command-line activities consistent with techniques used by state-sponsored actors. The rule looks for the execution of multiple native Windows reconnaissance or credential dumping commands from a single host and user, which is a common pattern for actors performing hands-on-keyboard operations after gaining initial access.
The analytic identifies the execution of the native mimikatz.exe binary on Windows systems, including instances where the binary is renamed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because Mimikatz is a widely used tool for extracting authentication credentials, posing a severe security risk. If confirmed malicious, this activity could allow attackers to obtain sensitive credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and system compromise.
This detection identifies the use of common post-exploitation tools like PsExec, Impacket (specifically WMIExec), and Mimikatz. These tools are frequently used by threat actors for lateral movement and credential access after gaining initial access. The rule looks for specific process names and command-line arguments indicative of these tools.
This rule detects attempts to transfer sensitive files containing credential data via network shares. It specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) and checks if the 'RelativeTargetName' of the accessed object contains well-known filenames or paths associated with credential storage, such as Mimikatz output, LSASS memory dumps, Windows minidumps, hibernation files, SQL dumps, or critical system files like NTDS.dit, SAM, SECURITY, and SYSTEM hives.
Search Common EventCodes (EventID’s) for Suspicious Behavior
KQL Query from file: High-Risk assets with command line credentials
KQL Query
KQL Query from file: CVE-2024-38200 NTLM Exposure Detection
KQL Query
SPL Query
SPL Query from file: NTDS.DIT Exfiltration Detection
Detects changes to the "DisableRestrictedAdmin" registry value, which controls RestrictedAdmin mode. Disabling RestrictedAdmin mode can expose credentials to compromise during Remote Desktop Protocol (RDP) connections, making it easier for adversaries to harvest credentials during lateral movement. This rule identifies modifications to this critical security setting.
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed
Page 16 of 24