Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
695 detections
Filters
Last updated
All Time
Detection languages
326
173
58
44
44
Contributors
156
121
115
103
37
Categories
372
299
272
219
57
Platforms
683
5
1
1
Products / Services
279
174
112
28
16
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
4
4
4
4
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects the setting of the "DumpType" registry value to "2" (Full Dump) within the Windows Error Reporting LocalDumps configuration. This specific setting is required by techniques like LSASS Shtinkering to facilitate dumping of the LSASS process memory, which often contains sensitive credential material.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory, which is a common technique used by attackers to steal credentials. The detection is specifically triggered by Windows Defender's Attack Surface Reduction (ASR) rule for blocking credential stealing from LSASS, indicated by EventID 1121 and the target path ending with '\lsass.exe'. The rule includes filters to reduce false positives from legitimate processes that might interact with LSASS.
This rule detects when an unsigned image (DLL or EXE) is loaded into the Local Security Authority Subsystem Service (LSASS) process. Adversaries often inject malicious, unsigned code into LSASS to dump credentials, as LSASS stores sensitive authentication material. Detecting unsigned code in this critical process can indicate an attempt at credential dumping or other forms of privilege escalation.
Detects attempts to access the LSASS process memory by tools or processes that have the keyword "dump" in their image name. This behavior is indicative of credential dumping activities, where adversaries try to extract sensitive information like passwords and hashes from the LSASS process.
This rule detects the use of the legitimate Microsoft SQL Server utility `sqldumper.exe` to dump process memory. Specifically, it looks for `sqldumper.exe` being executed with command-line arguments that indicate an attempt to dump a process, such as '0x0110' or '0x01100:40'. This technique can be abused by attackers to dump sensitive processes like LSASS (Local Security Authority Subsystem Service) to extract credentials.
Detects the creation of a file named 'debug.bin' in the '\Temp\' directory, which is the default output filename used by the SafetyKatz tool for dumping LSASS memory. This activity is indicative of an attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process.
Detects the loading of unsigned dbghelp.dll or dbgcore.dll, which are DLLs used for creating memory dumps. This activity is suspicious as these DLLs are often leveraged by attackers, for example, to dump credentials from processes like LSASS using the MiniDumpWriteDump API. Tools like ProcessHacker and the SilentTrinity C2 Framework are known to use this technique.
Detects the loading of DLLs associated with the Time Travel Debugging (TTD) utility. Adversaries can leverage TTD, specifically `tttracer.exe`, to execute malicious processes or dump sensitive process memory, such as that of `lsass.exe`, for credential access. This rule focuses on the dynamic loading of TTD-related DLLs, indicating potential use of the utility.
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass. This technique is often used to extract credentials.
Detects suspicious process patterns indicative of CrackMapExec (CME) being used to dump LSASS credentials. The rule looks for specific command-line arguments used by CME for LSASS dumping, including combinations of 'tasklist' with 'Imagename eq lsass.exe', 'rundll32.exe' with 'comsvcs.dll' and temporary paths, and 'tasklist' with 'findstr /i "lsass"'. These patterns are commonly observed when attackers attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory.
Detects changes to the Windows Registry that configure a monitor program to dump the memory of the lsass.exe process using the SilentProcessExit technique. This method leverages Image File Execution Options (IFEO) to trigger a memory dump of LSASS when it exits, which can be used to extract credentials.
This rule detects the creation of a file named 'lsass.exe.dmp' within the 'C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\' directory. This specific file pattern and location are indicative of an attempt to dump the LSASS process memory, which often contains sensitive credential material. Adversaries frequently use this technique to extract credentials for lateral movement or persistence. The rule specifically references the 'LSASS Shtinkering' technique, which abuses Windows Error Reporting to achieve LSASS memory dumping.
Detects `rundll32.exe` loading a renamed `comsvcs.dll` to dump process memory, which is a common technique for credential dumping, specifically targeting LSASS. The rule looks for `rundll32.exe` executions where the loaded image is NOT the legitimate `comsvcs.dll` (implying a renamed or malicious version).
Detects attempts to dump LSASS process memory using WerFault.exe. This technique is often used by tools like Mimikatz, NanoDump, Invoke-Mimikatz, Procdump, or Taskmgr to extract credentials from the Local Security Authority Subsystem Service (LSASS) process. The rule specifically looks for WerFault.exe accessing lsass.exe with a GrantedAccess of '0x1FFFFF', which indicates full access.
Detects a possible process memory dump of lsass.exe using a renamed or masqueraded executable named 'TrolleyExpress.exe'. This technique leverages the whitelisted nature of the legitimate Citrix TrolleyExpress.exe to evade detection while attempting to dump LSASS memory, often indicated by command-line arguments targeting process IDs in the 700-999 range or the '-ma' flag for memory dumping.
Detects the use of Cobalt Strike commands entered into the command shell. This rule specifically looks for common Cobalt Strike post-exploitation commands such as 'psinject', 'spawnas', 'make_token', 'remote-exec', 'rev2self', 'dcsync', 'logonpasswords', 'execute-assembly', and 'getsystem' when executed via cmd.exe. This often indicates an operator error where Cobalt Strike commands are mistakenly typed directly into a compromised system's command prompt instead of the Cobalt Strike beacon console.
Detects the presence of keywords like "lsass" and ".dmp" in the command line, which indicates a potential attempt to dump the LSASS process memory. This technique is commonly used by adversaries to extract credentials.
Detects when a non-Sysinternals tool attempts to set the 'EulaAccepted' registry key for a Sysinternals tool. This behavior is indicative of an adversary attempting to use renamed Sysinternals tools to evade detection, as the 'EulaAccepted' key is typically set by the legitimate Sysinternals tool upon its first execution.
This rule detects the execution of a PowerShell command containing 'Get-Process lsass' within a script block. This command is commonly used by attackers to identify the LSASS process ID before attempting to dump its memory for credential harvesting. The detection relies on PowerShell Script Block Logging being enabled.
Detects suspicious access to the Local Security Authority Subsystem Service (LSASS) process memory. This rule specifically looks for access to 'lsass.exe' originating from 'svchost.exe' with a specific suspicious access right ('0x14c0') and a call trace indicating 'seclogon.dll'. This combination suggests an attempt to dump LSASS memory, potentially to steal credentials.
Detects a possible process memory dump of LSASS using processes with whitelisted filenames (like TrolleyExpress.exe, ProcessDump.exe, dump64.exe) to evade detection by security products like Microsoft Defender. The rule specifically looks for access to lsass.exe with granted access rights commonly associated with memory dumping.
Page 31 of 34