Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
This rule correlates three distinct events to detect a potential credential theft and lateral movement chain: an LSASS credential dump, followed by an NTLM network logon, and then a DCOM activation of mmc.exe with the '-Embedding' flag on the target system. This sequence of events is indicative of an attacker compromising credentials, using them to move laterally, and then potentially executing further commands or tools via DCOM.
Detects credential harvesting portals from evil twin Wi-Fi access points
AD Explorer Creates a Directory Snapshot
Cortex XDR
Detects AD Explorer running with the snapshot option and writing result.dat into a temporary directory. This activity is often associated with reconnaissance and credential dumping in Active Directory environments.
This rule monitors for large outbound network data transfers (greater than 10MB) over standard web ports (80/443) initiated by processes typically associated with office productivity applications (e.g., WinWord, Excel, Outlook) or credential dumping tools (lsass.exe). It further correlates this activity with preceding network connections to common directory service ports (LDAP/Global Catalog) on the same host, indicating potential credential collection followed by data exfiltration.
Detects Python executing adconnectdump.py, which targets credentials stored by Microsoft Entra Connect. This tool is used to dump credentials from Microsoft Entra Connect (formerly Azure AD Connect) installations.
This rule detects attempts by non-browser processes to access sensitive files that commonly contain credentials, such as browser login data (Chrome, Firefox) or the Windows Security Account Manager (SAM) database. This activity could indicate credential dumping or information theft.
Detects suspicious command-line activity involving utilities that contain 'checksum' or 'hash' in their command line, potentially indicating file integrity checks, malware analysis evasion, or credential dumping attempts. The rule triggers if five or more such commands are executed within an hour by the same account on the same computer.
Detects various methods and tools commonly used by adversaries for credential dumping, including process memory dumping of lsass.exe via procdump or comsvcs.dll, and the execution of credential dumping tools like Impacket's secretsdump, ntlmrelayx, or Mimikatz.
This rule monitors process execution events for the usage of common memory dumping utility names (e.g., procdump, memdump, coredump, crashdump) via command-line interfaces such as cmd.exe or powershell.exe. This activity is frequently associated with attackers attempting to dump sensitive process memory, such as LSASS, to extract credentials or other secrets from memory.
Detects unauthorized cross-process handle requests to sensitive Windows authentication processes (lsass.exe and winlogon.exe) by non-system and non-whitelisted processes. This behavior is commonly associated with credential dumping techniques and malicious process injection aimed at stealing sensitive authentication data.
Detects unauthorized cross-process handle requests to sensitive Windows authentication processes (lsass.exe and winlogon.exe) by non-system and non-whitelisted processes. This behavior is commonly associated with credential dumping techniques and malicious process injection aimed at stealing sensitive authentication data.
Detects the execution of pg_dump or pg_restore initiated by Splunk processes with unexpected remote hosts or custom directories. This behavior is indicative of CVE-2026-20253 exploitation, where an unauthenticated attacker can abuse the PostgreSQL Sidecar Service to achieve remote code execution.
This rule monitors process execution events for the usage of common memory dumping utility names (e.g., procdump, memdump, coredump, crashdump) via command-line interfaces such as cmd.exe or powershell.exe. This activity is frequently associated with attackers attempting to dump sensitive process memory, such as LSASS, to extract credentials or other secrets from memory.
Detects PowerShell invoking advapi32.dll for CredEnumerate.
Detects access to NTDS.dit for Active Directory credential dumping
This rule detects the presence of files on endpoints that match a list of known malicious SHA256 hashes associated with the Nuso malware. It queries DeviceFileEvents to identify any file with a matching hash.
Detects attempts to read the memory of browser processes (Chrome, Edge, Firefox, Brave, Opera). This activity can be indicative of credential dumping or other forms of data exfiltration from web browsers.
This rule detects unauthorized attempts to extract credentials from the Veeam Backup and Replication PostgreSQL database. It identifies malicious activity involving the use of PowerShell to interact with the database, including direct psql.exe command line execution, PowerShell scripts referencing sensitive database keywords, WMI-spawned PowerShell processes, and network connections to the PostgreSQL service port (5432).
This rule detects suspicious process activity indicative of the Remcos RAT attempting to extract credentials from web browsers like Chrome, Firefox, or Opera. It specifically looks for `Remcos` related processes initiating browser executables with command-line arguments often associated with credential dumping or unusual browser behavior, such as `--allow-file-access`, `--no-sandbox`, `--headless`, or referencing a 'profile'.
Detects the execution of processes with command-line arguments characteristic of the Mimikatz tool, specifically the 'sekurlsa', 'lsadump', and 'privilege::debug' modules used for credential dumping and process debugging.
Detects execution of the login-information extractor SharpGetUserLoginIPRP with embedded user, password, host, and day-range parameters. This tool is known to collect domain logon data.
Page 8 of 24