Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
Detects attempts to dump credentials using 'reg save HKLM\SAM' command or the 'impacket-secretsdump' tool. These methods are commonly used by adversaries to extract password hashes from the Security Account Manager (SAM) database or other credential stores for offline cracking or reuse.
This rule monitors for a sequential attack chain occurring within a 15-minute window. It links a high-risk or risky user sign-in to subsequent reconnaissance (whoami, ipconfig), credential access (LSASS dumping, registry hive export), and lateral movement (network connections over port 445).
This rule monitors for a sequential attack chain occurring within a 15-minute window. It links a high-risk or risky user sign-in to subsequent reconnaissance (whoami, ipconfig), credential access (LSASS dumping, registry hive export), and lateral movement (network connections over port 445).
Detects attempts to read the 'Groups.xml' file within the SYSVOL share. This file can contain sensitive credential information if Group Policy Preferences were used to deploy local user accounts or services, as the passwords might be stored in a decryptable format. Adversaries often target this file to extract credentials.
Hunting rule: correlate with additional signals before alerting.
Detects vssadmin shadow copy creation commonly preceding NTDS or SAM extraction.
Detects vssadmin shadow copy creation commonly preceding NTDS or SAM extraction.
Detects theft of Kerberos ccache files containing valid session credentials
Detects processes containing sensitive credential-related keywords (cookies, creds, password, token) in their command lines followed by a network connection to known suspicious remote IP addresses within a 60-minute window, suggesting potential credential exfiltration.
Detects the creation or referencing of 'lopa.txt' which the Seedworm threat group uses to save stolen passwords. This rule identifies processes that interact with 'lopa.txt' either through their command line arguments or by directly accessing a file with that name.
Detects known malicious file hashes associated with malware families (VIDAR, LUMMAC.V2, RADTHIEF, ATOMIC) distributed by the threat actor UNC5142.
This rule detects command-line activity indicative of encryption key extraction or dumping. It looks for specific keywords like 'dumpkey', 'exportkey', 'savekey', 'keystore', and 'privkey' in the command line of processes such as 'servertool.exe', 'encrypt.exe', 'powershell.exe', and 'cmd.exe'. This activity is often associated with ransomware or other malicious software attempting to exfiltrate cryptographic keys.
Detects potential credential dumping activity where ManageEngine ADSelfService processes initiate other processes commonly associated with credential dumping, such as taskmgr.exe, lsass.exe, winlogon.exe, or wlrmdr.exe. This behavior could indicate an adversary attempting to extract credentials.
Hunting rule for "Dump Credential Manager using keymgr.dll and rundll32.exe" (OS Credential Dumping) using command-line and process indicators derived from executor behavior.
Detects the execution of 'moladb_hash_crack.py', a script known to be used by the MuddyWater APT group for credential operations, specifically hash cracking. This rule identifies process command lines containing the script's filename.
Identifies the AppleScript stealer validating the phished user password locally using the dscl . -authonly command.
Detects the threat actor utilizing the TiFlux backdoor access to run credential dumping tools (Mimikatz, Procdump) against LSASS.
Detects the use of 'credwiz.exe' with the 'B' argument, which indicates a credentials backup operation. This activity could be indicative of an adversary attempting to dump credentials from a compromised system.
Detects the 'strings' command being run directly against /proc/*/mem to extract human-readable strings (such as tokens or passwords) from raw memory. This activity is often associated with credential dumping techniques on Linux systems.
correlate with additional signals before alerting.
Detects wmic shadowcopy create used to stage credential database extraction.
Detects wmic shadowcopy create used to stage credential database extraction.
This rule detects when the 'Groups.xml' file within the SYSVOL folder is read. This file can contain sensitive credential information, such as passwords for service accounts, if Group Policy Preferences (GPP) were used to deploy them. Attackers often target this file to extract credentials for privilege escalation or lateral movement.
Detects reg.exe saving the SYSTEM hive to \Windows\Temp\. This activity is often associated with credential dumping techniques where adversaries extract the SAM database for offline cracking.
Detects pythonw.exe accessing multiple distinct browser credential stores within a tight 2-minute window, indicative of information stealer behavior (e.g., Vidar stealer). The rule specifically looks for access to 'Login Data', 'Cookies', 'Web Data', and 'places.sqlite' files.
Page 9 of 24