Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
This rule detects the execution of Mimikatz or the use of its common command-line arguments, which are indicative of credential dumping and post-exploitation activities. It monitors process creation events for the 'mimikatz.exe' binary or command-line patterns associated with credential theft techniques such as dumping LSASS memory, extracting passwords, or Kerberos ticket manipulation.
This rule detects potential credential dumping activities by monitoring for the execution of Mimikatz or command-line arguments associated with credential extraction (e.g., 'sekurlsa::logonpasswords'). Additionally, it monitors for suspicious process access attempts to 'lsass.exe' with specific high-privileged access masks often used by credential dumping tools to read process memory.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence.
If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) terminates shortly after loading the Data Protection API service (dpapisvc.dll). This pattern may indicate an attempt to interact with or disrupt DPAPI services, potentially to facilitate credential dumping or sensitive data access.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
Detects ERAAgent.exe (ESET Remote Administrator Agent) interacting with suspicious named pipes (e.g., mojo, spoolss) and attempts to extract credentials from command line parameters, indicating potential credential dumping or lateral movement techniques using the agent process.
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
Detects ERAAgent.exe (ESET Remote Administrator Agent) interacting with suspicious named pipes (e.g., mojo, spoolss) and attempts to extract credentials from command line parameters, indicating potential credential dumping or lateral movement techniques using the agent process.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) terminates shortly after loading the Data Protection API service (dpapisvc.dll). This pattern may indicate an attempt to interact with or disrupt DPAPI services, potentially to facilitate credential dumping or sensitive data access.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
Page 3 of 24