Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
201 detections
Filters
Last updated
All Time
Detection languages
113
61
11
8
2
Contributors
57
40
32
13
8
Categories
94
86
76
37
36
Platforms
198
5
3
2
1
Products / Services
70
51
41
19
8
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
8
IDS Classtypes
1
1
IDS Protocols
1
1
Detects the registration of the VSSAudit security event source, which typically occurs during volume shadow copy operations. This can be indicative of credential dumping attempts, specifically targeting the Security Account Manager (SAM) database.
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name (SAM or SECURITY) located in the temporary directory have been reset. This behavior can occur when an application attempts to access a hive that has not been recognized for a period (default 7 days). Registry hive dumping utilities such as QuarksPwDump have been observed to exhibit this behavior, which is often associated with credential dumping.
This rule detects the creation of a dump file by the password dumper tool QuarksPwDump. Specifically, it looks for files created in the 'AppData\Local\Temp\' directory with names starting with 'SAM-' and ending with '.dmp'. This pattern indicates that QuarksPwDump is attempting to dump the Security Account Manager (SAM) database, which contains local user credentials.
Detects the usage of 'reg.exe' to dump sensitive registry hives, specifically targeting the SAM, SYSTEM, and SECURITY hives. This activity is indicative of credential dumping attempts.
This rule detects the creation of shadow copies using operating system utilities such as PowerShell, WMIC, or VSSAdmin. Adversaries often create shadow copies to access credential material, specifically the NTDS.dit file or SAM database, for offline analysis. The rule looks for specific executable names combined with command-line arguments containing 'shadow' and 'create'.
Detects the use of esentutl.exe to interact with Volume Shadow Copy Service (VSS) registry keys. This activity can be indicative of attempts to access or dump credentials, particularly from the Security Account Manager (SAM) database, which is often stored in the registry and can be targeted via VSS snapshots.
This rule detects the creation of a symbolic link (symlink) to a Volume Shadow Copy using the 'mklink' command-line utility. Adversaries often create symlinks to shadow copies to access and exfiltrate sensitive data, such as credential hashes from the Security Account Manager (SAM) database or the Active Directory database (NTDS.dit), without directly interacting with the live system files. This technique is commonly used as part of credential dumping activities.
Detects the usage of 'pypykatz' to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored. The rule specifically looks for the execution of 'pypykatz.exe' or 'python.exe' with command-line arguments indicating 'live' and 'registry' access, which are common parameters for dumping credentials from the live registry hive.
This rule detects suspicious PowerShell scripts attempting to copy the Security Account Manager (SAM) database. It specifically looks for PowerShell command lines that include both a reference to a volume shadow copy (e.g., '\HarddiskVolumeShadowCopy') and the SAM file path ('System32\config\sam'), combined with common PowerShell copy commands or .NET file copy methods. This activity is indicative of an adversary trying to extract credentials by accessing the SAM database, often from a shadow copy to bypass file locks.
This rule detects the use of the built-in Windows 'copy' command via 'cmd.exe' to transfer files with '.dmp', '.dump', or '.hdmp' extensions from a remote network share (indicated by '\\') to a local system. This activity is often associated with credential dumping techniques where memory dumps (e.g., LSASS process memory dumps) containing sensitive information are exfiltrated or staged.
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects well-known credential dumping tools execution via service execution events
Detects a dump file written by QuarksPwDump password dumper
Detects well-known credential dumping tools execution via specific named pipe creation
Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
Detect AD credential dumping using impacket secretdump HKTL
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
Detects volume shadow copy mount via Windows event log
Detects well-known credential dumping tools execution via service execution events
Page 9 of 10