Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
This query looks for signs of credential dumping based on process activity instead of targeting process names.
Author: Jouni Mikkola
More info: https://threathunt.blog/lsass-credential-dumping/
Author: Jouni Mikkola
More info: https://threathunt.blog/lsass-credential-dumping/
Detects Credential Acquisition via Registry Hive Dumping
Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Shadow Copies creation using operating systems utilities, possible credential access
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Detects Credential Acquisition via Registry Hive Dumping
Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe".
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.
Threat actors performed dumping of SAM, SECURITY and SYSTEM registry hives using DelegateExecute key
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file
This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects if Qakbot has injected code into the ping.exe process, to evade security and access credentials.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects if Qakbot has injected code into the ping.exe process, to evade security and access credentials.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Assuming that you have a machine that is properly BitLocker'ed, then
the machine will need to be running to extract the SAM and SYSTEM
files.
This first query looks for any access to the HKLM that happens via a command
or script that is not executed by system.
The second query looks for usage of reg or regedit by anyone who is not system.
the machine will need to be running to extract the SAM and SYSTEM
files.
This first query looks for any access to the HKLM that happens via a command
or script that is not executed by system.
The second query looks for usage of reg or regedit by anyone who is not system.
This query searches for the HASHs of the FireEye Red Team tools compromised by the Nobelium activity group.
See all-hashes.csv on the official FireEye repo.
References:
https://github.com/fireeye/red_team_tool_countermeasures/blob/master/all-hashes.csv
https://github.com/fireeye
See all-hashes.csv on the official FireEye repo.
References:
https://github.com/fireeye/red_team_tool_countermeasures/blob/master/all-hashes.csv
https://github.com/fireeye
wifikeys
KQL
Detect if someone run netsh and try to expose WPA keys in clear text
@mattiasborg82.
Blog.sec-labs.com.
@mattiasborg82.
Blog.sec-labs.com.
Page 19 of 24