Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
695 detections
Filters
Last updated
All Time
Detection languages
326
173
58
44
44
Contributors
156
121
115
103
37
Categories
372
299
272
219
57
Platforms
683
5
1
1
Products / Services
279
174
112
28
16
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
4
4
4
4
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes.
Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
Loading unsigned image (DLL, EXE) into LSASS process
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.
Detects LSASS process access requests from a source process with the "dump" keyword in its image name.
Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference
Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Detects suspicious process patterns found in logs when CrackMapExec is used
Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool
Detects the execution of the hacktool SafetyKatz via PE information and default Image name
Detects process dump via legitimate sqldumper.exe binary
Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass
Detects the use of Windows Credential Editor (WCE)
Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.
Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.
Detection well-known mimikatz command line arguments
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects suspicious use of XORDump process memory dumping utility
Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Page 33 of 34