Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.
Detects process execution events involving database-related commands that may indicate credential tampering or illicit database backups, often associated with database credential theft or exfiltration attempts.
Detects process execution events involving database-related commands that may indicate credential tampering or illicit database backups, often associated with database credential theft or exfiltration attempts.
Detects suspicious processes based on name and location that access the windows credential manager and vault.
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
Detects credential dumping of the TermService svchost process that can retain plaintext
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
Detects suspicious execution of tools or command lines associated with DPAPI domain backup key extraction, including mimikatz, SharpDPAPI, lsadump::backupkeys, and related backupkey commands. This behavior may indicate an attempt to obtain the domain DPAPI backup key from a Domain Controller, enabling decryption of DPAPI-protected secrets across the domain.
Detects abuse of comsvcs.dll MiniDump export to dump LSASS or other process memory
for credential access.
for credential access.
Detects credential dumping of the TermService svchost process that can retain plaintext
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
Detects the use of the native Windows 'reg.exe' utility to save or export sensitive registry hives (SAM, SECURITY, or SYSTEM). This activity is a classic technique used by adversaries to perform offline credential dumping.
Detects the execution of the Mimikatz credential dumping tool, either as the initiating process or the action process, indicating potential credential theft attempts.
This rule detects the execution of the Mimikatz credential dumping tool by monitoring for specific process names or command-line arguments, including the use of 'sekurlsa' modules to harvest credentials from memory. Mimikatz is widely used by adversaries to perform credential theft, including dumping passwords, hashes, and Kerberos tickets from memory.
Detects the execution of SniffPass, a known network password recovery tool often used by adversaries to capture passwords from various network protocols (e.g., POP3, IMAP, SMTP, FTP, and HTTP). The rule monitors process execution events for known SniffPass binary names and SHA256 hashes.
This rule detects processes that load Pluggable Authentication Modules (PAM) libraries (libpam) and subsequently initiate network connections within a 30-minute window. This behavior is often associated with credential dumping tools or malicious implants attempting to exfiltrate cached credentials or session information from memory on Linux and macOS systems.
Detects the execution of Mimikatz with command line arguments indicative of credential dumping, specifically DCSync attacks or dumping LSASS memory for passwords. The rule filters out processes signed by Microsoft to reduce noise.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
Detects the use of the native Windows 'reg.exe' utility to export sensitive registry hives (SAM, SECURITY, SYSTEM) commonly targeted by adversaries for offline credential extraction.
Detects instances where the Windows Error Reporter (wermgr.exe) process attempts to open a handle to a Volume Shadow Copy (VSS) device. This behavior is anomalous as legitimate VSS operations are typically performed by dedicated system processes (e.g., vssvc.exe, diskshadow.exe), and such access by wermgr.exe may indicate an attempt to bypass file locks for credential dumping or sensitive data exfiltration.
Detects the simultaneous execution of QEMU virtualization processes and post-exploitation tools (Metasploit, Impacket, Havoc, NXC) on the same host. This combination is indicative of an adversary using a local virtual machine to tunnel or pivot lateral movement activities while leveraging post-exploitation frameworks on the host system, a behavior observed in specific campaigns.
Detects attempts to access or copy the Active Directory domain database (NTDS.dit), which contains sensitive credential material. The rule monitors for the use of built-in administrative tools such as esentutl, ntdsutil, vssadmin, and wbadmin, as well as file copy utilities (robocopy, xcopy) when specifically targeting the NTDS directory or volume shadow copies containing the database file.
Detects execution of Node.js processes associated with the TaskWeaver JavaScript loader. The rule monitors for unauthorized Node.js processes (lacking official publisher signatures) spawning secondary processes or executing specific suspicious command lines linked to TaskWeaver and Djinn Stealer activity, such as loading obfuscated jquery.js or accessing configuration files associated with credential theft.
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
Page 5 of 24