Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
Detects instances where the Active Directory domain database file (ntds.dit) is accessed by processes other than known legitimate tools such as lsass.exe or ntdsutil.exe. This activity is a strong indicator of credential dumping attempts to extract Active Directory hashes.
Detects the presence and execution of 'FortiEndpoint_Patch.exe' from non-standard locations (C:\ProgramData) used for masquerading, or the invocation of the ElevationKatz command-line tool (runhlp.exe --v20-decrypt) used to perform credential decryption.
Detects the execution of mimikatz.exe or the usage of the sekurlsa::logonpasswords command, both of which are indicative of attempts to extract sensitive credentials from LSASS memory.
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
Detects potential credential harvesting attempts by monitoring for the usage of Windows credential management tools (cmdkey.exe and vaultcmd.exe) and the loading of sensitive DLLs (vaultcli.dll, dpapi.dll) by non-Microsoft signed processes, which is commonly used to access stored credentials in the Windows Vault or by DPAPI-protected stores.
Hunting rule for Linux procfs heap credential harvesting: resolve a target PID
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
Hunting rule for Linux procfs heap credential harvesting: resolve a target PID
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
This rule detects the execution of processes with command-line arguments indicative of Mimikatz usage. It specifically looks for the strings 'mimikatz', 'sekurlsa', or 'privilege::debug' in the command line of newly created processes (EventID 4688). This activity is commonly associated with credential dumping.
Detects potential credential harvesting attempts by monitoring for the usage of Windows credential management tools (cmdkey.exe and vaultcmd.exe) and the loading of sensitive DLLs (vaultcli.dll, dpapi.dll) by non-Microsoft signed processes, which is commonly used to access stored credentials in the Windows Vault or by DPAPI-protected stores.
Search Common EventCodes (EventID’s) for Suspicious Behavior
This rule detects the presence of MicroStealer malware by matching known MD5, SHA1, or SHA256 hashes of its binaries against file events on monitored devices. MicroStealer is a credential stealer that targets various applications to exfiltrate sensitive information.
This rule detects an unusually high number of outbound network connections originating from the Local Security Authority Subsystem Service (LSASS) process on a Windows machine. LSASS is a critical system process responsible for enforcing security policy on the system, including user authentication, and typically does not initiate a large number of outbound connections. A high count of outbound connections from LSASS could indicate credential dumping activity, where an attacker is exfiltrating harvested credentials, or other malicious activity compromising the LSASS process.
Detects attempts to read the memory of browser processes (Chrome, Edge, Firefox, Brave, Opera). This activity can be indicative of credential dumping or other forms of data exfiltration from web browsers.
This rule detects repeated access attempts (3 or more within an hour) to critical credential storage processes or files, specifically lsass.exe, the Security Account Manager (SAM) database, or the NTDS.dit file. Such activity is indicative of credential theft attempts by an adversary.
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
Detects attempts by non-system user accounts to access the SAM or SECURITY registry hives. These hives contain sensitive credential material, and unauthorized access is a common indicator of credential dumping activities, often associated with tools like Mimikatz or scripts attempting to extract local account hashes.
Detects instances where the Active Directory domain database file (ntds.dit) is accessed by processes other than known legitimate tools such as lsass.exe or ntdsutil.exe. This activity is a strong indicator of credential dumping attempts to extract Active Directory hashes.
Detects attempts by non-system user accounts to access the SAM or SECURITY registry hives. These hives contain sensitive credential material, and unauthorized access is a common indicator of credential dumping activities, often associated with tools like Mimikatz or scripts attempting to extract local account hashes.
Detects attempts to access browser credential stores or LSASS process memory by unexpected processes. This rule identifies suspicious file access patterns to browser login data files (Chrome, Edge, Firefox, Brave) by non-browser executables, as well as unauthorized access to LSASS process memory via Sysmon Event ID 10 or Windows Security Event 4656 by non-system processes. These activities are indicative of credential dumping or theft.
This rule detects known credential dumping activity, specifically focusing on the execution of Mimikatz (or renamed variants) and the use of built-in system tools like comsvcs.dll or procdump to dump lsass.exe process memory.
This rule detects potentially malicious activity involving the CredentialUIBroker.exe process or the use of SetWindowsHookEx API calls. These behaviors are often associated with attempts to intercept user input or dump credentials from system processes.
Page 6 of 24