Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
695 detections
Filters
Last updated
All Time
Detection languages
326
173
58
44
44
Contributors
156
121
115
103
37
Categories
372
299
272
219
57
Platforms
683
5
1
1
Products / Services
279
174
112
28
16
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
4
4
4
4
1
IDS Classtypes
2
1
IDS Protocols
2
1
Procdump Execution
Sigma
Detects the execution of the SysInternals Procdump utility. Procdump can be used by adversaries to dump process memory, including sensitive processes like LSASS, for credential access.
Detects the execution of 'DumpMinitool.exe', a tool used to dump process memory, specifically targeting the 'MiniDumpWriteDump' function. This tool can be used to extract credentials from processes like LSASS.
Detects suspicious execution of 'DumpMinitool.exe', a binary that can be used for credential dumping. The rule looks for executions outside of typical Visual Studio directories, or executions with command-line arguments indicative of memory dumping (e.g., '.txt', 'Full', 'Mini', 'WithHeap') unless the '--dumpType' flag is also present, which might indicate legitimate usage.
Detects the execution of "AdPlus.exe", a legitimate Windows SDK binary that can be abused as a Living Off The Land Binary (LOLBIN) to dump process memory (potentially including LSASS) or execute arbitrary commands. The rule specifically looks for command-line arguments indicative of these malicious uses, such as dumping process memory, using a config file, or executing inline commands.
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.). This technique is often used to dump LSASS memory for credential access.
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)
Detects the execution of Dumpert, a tool used to dump the memory of the lsass.exe process, which often contains sensitive credential material. Detection is based on specific MD5 hash values or the presence of 'Dumpert.dll' in the command line.
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behavior is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
Detects the execution of the `CreateMiniDump.exe` utility or a process with a specific import hash associated with `CreateMiniDump`, which is used to dump the LSASS process memory for credential extraction. This tool is often used by attackers to bypass antivirus signatures that might detect `mimikatz` or similar tools.
Detects the execution of HandleKatz, a tool designed to dump LSASS memory using cloned handles. The rule identifies the tool by its executable name ('loader.exe'), specific command-line arguments including '--pid:', '--outfile:', and keywords like '.dmp', 'lsass', '.obf', or 'dump', and known IMPHASH values associated with HandleKatz.
Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine
Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same
Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process with suspicious access masks. Adversaries often target LSASS to dump credentials for lateral movement or privilege escalation. The rule looks for specific access mask values in Windows Security Event IDs 4656 (handle requested) and 4663 (object access attempt) that are indicative of credential dumping activities, while filtering out known legitimate processes.
Detects the creation of files with names commonly used by various memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. This includes specific filenames and patterns associated with tools like Procdump, MirrorDump, PPLBlade, RustiveDump, NativeDump, and Nanodump.
Detects process access requests from known hacktool processes based on their executable names. This rule targets a wide range of tools commonly used for credential dumping, privilege escalation, and other malicious activities, including Mimikatz, various Potato exploits, and other offensive security tools. The detection focuses on the 'SourceImage' field, indicating the process initiating the access.
Detects suspicious process access requests to the LSASS process using specific GrantedAccess flags. These flags are often associated with tools and techniques used for credential dumping, such as Mimikatz, by attempting to read or manipulate LSASS memory to extract credentials. The rule includes filters for common legitimate processes like antivirus software, EDRs, and system utilities to reduce false positives.
Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.
Detects process access requests from hacktool processes based on their default image name
Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager, a common technique for credential access.
This rule detects the transfer of sensitive files containing credential data over network shares. It specifically looks for filenames or paths commonly associated with credential dumping, such as 'mimidrv', 'lsass', 'windows\minidump\', 'hiberfil', 'sqldmpr', 'sam', 'ntds.dit', and 'security'. This activity often indicates an attempt to exfiltrate credentials after they have been dumped from a system.
Page 29 of 34