Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
275 detections
Filters
Last updated
All Time
Detection languages
117
97
21
13
9
Contributors
57
50
47
36
28
Categories
164
147
110
63
38
Platforms
269
6
4
1
1
Products / Services
98
88
48
25
19
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike
Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)
Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Detects the launch of specific utilities (like ntdsutil, vssadmin, diskshadow, esentutl) on key servers. These utilities can be used by adversaries to access or copy the Active Directory domain database (NTDS.dit) or inhibit system recovery, which are common techniques for credential dumping and persistence.
This rule detects attempts to extract the ntds.dit file, which contains Active Directory credential information, using `wmic` in conjunction with `vssadmin.exe` or `ntdsutil.exe`. It also identifies the creation of `.dit` files in temporary directories and specific ESENT application event logs associated with NTDS database activity. This activity is indicative of credential dumping, a common post-exploitation technique.
This rule detects the execution of 'esentutl' with the '/p' parameter. This command-line utility is used for database utilities, and its use with '/p' (repair mode) can be leveraged by adversaries to access or repair Extensible Storage Engine (ESE) databases, including the NTDS.dit file which contains Active Directory credential information. This technique has been observed in use by threat actors like Conti ransomware and Trickbot to gather credentials or other sensitive information from compromised systems.
Detects process launches from processes related to ntds against key servers
Detects extraction of ntds.dit file using vssadmin.exe or ntdsutil.exe with wmic as identified in CISA Living off the Land pdf
This rule detects the execution and usage of the DSInternals PowerShell module. DSInternals is a powerful tool that exposes internal features of Active Directory and Azure Active Directory, enabling actions such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, and recovering Domain Controllers from IFM backups. The rule specifically looks for a wide range of DSInternals cmdlets being executed via the command line.
Detects the execution and usage of the DSInternals PowerShell module. This module can be used to perform suspicious activities such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, recovering domain controllers from IFM backups, and calculating password hashes. The rule specifically looks for a wide range of cmdlets associated with the DSInternals module within PowerShell script block logs.
This analytic detects attempts to dump credentials from a shadow copy using the copy command. It specifically looks for processes executing commands that reference critical credential files like "sam", "security", "system", and "ntds.dit" within system directories. Such activity is a strong indicator of credential extraction, which can lead to unauthorized access, privilege escalation, lateral movement, and sensitive data compromise.
The analytic detects the creation of shadow copies using `vssadmin.exe` or `wmic.exe`. This activity is significant because creating shadow copies can be a precursor to ransomware attacks or data exfiltration, allowing attackers to bypass file locks and access sensitive data. If confirmed malicious, this behavior could enable attackers to maintain persistence, recover deleted files, or prepare for further malicious activities, posing a significant risk to the integrity and confidentiality of the system. Adversaries may create shadow copies to access the NTDS.dit file for credential dumping or to exfiltrate data.
The following analytic detects the creation of shadow copies using "wmic" or "Powershell" commands. It leverages the Endpoint.Processes data model in Splunk to identify processes where the command includes "shadowcopy" and "create". This activity is significant because it may indicate an attacker attempting to manipulate or access data in an unauthorized manner, potentially leading to data theft or manipulation. If confirmed malicious, this behavior could allow attackers to backup and exfiltrate sensitive data or hide their tracks by restoring files to a previous state after an attack.
The following analytic detects the use of Ntdsutil to export the Active Directory database (NTDS.dit). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because exporting NTDS.dit can be a precursor to offline password cracking, posing a severe security risk. If confirmed malicious, an attacker could gain access to sensitive credentials, potentially leading to unauthorized access and privilege escalation within the network.
The analytic detects the potential use of the secretsdump.py tool to dump NTLM hashes from a copy of ntds.dit and the SAM, SYSTEM, and SECURITY registry hives. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns and process names associated with secretsdump.py. This activity is significant because it indicates an attempt to extract sensitive credential information offline, which is a common post-exploitation technique. If confirmed malicious, this could allow an attacker to obtain NTLM hashes, facilitating further lateral movement and potential privilege escalation within the network.
The analytic detects the creation of a symlink to a shadow copy, which may indicate credential dumping attempts. It identifies processes executing commands containing "mklink" and "HarddiskVolumeShadowCopy". This activity is significant because attackers often use this technique to manipulate or delete shadow copies, hindering system backup and recovery efforts. If confirmed malicious, this could prevent data restoration, complicate incident response, and lead to data loss or compromise. Analysts should review the process details, user, parent process, and any related artifacts to identify the attack source.
Page 11 of 14