Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
275 detections
Filters
Last updated
All Time
Detection languages
117
97
21
13
9
Contributors
57
50
47
36
28
Categories
164
147
110
63
38
Platforms
269
6
4
1
1
Products / Services
98
88
48
25
19
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects suspicious child processes spawned by web servers, indicating potential webshell activity used for credential dumping, exfiltration, or other post-exploitation actions. The rule looks for specific command-line patterns and executables commonly associated with these malicious activities originating from known web server processes.
This rule detects the use of 'wbadmin.exe' to recover files from backups. Adversaries may use this technique to restore sensitive files, such as NTDS.DIT (Active Directory database) or Registry Hives, from backups. These files can then be analyzed offline to extract credentials or other sensitive information, potentially leading to further compromise.
Detects the use of 'wbadmin.exe' to recover highly sensitive files such as 'NTDS.DIT', 'SAM', 'SECURITY', and 'SYSTEM' hives. Attackers can leverage this utility to dump sensitive files that might contain credential or other sensitive information.
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive using the `wbadmin.exe` utility. Attackers can leverage `wbadmin` to dump sensitive files that might contain credentials or other sensitive information.
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.
Detects attempts to dump Active Directory credentials using Impacket's secretdump tool. This rule specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) on the ADMIN$ share, combined with access to a temporary file within the SYSTEM32 directory. This pattern is indicative of secretdump's remote activity to extract credential hashes.
This rule detects the transfer of sensitive files containing credential data over network shares. It specifically looks for filenames or paths commonly associated with credential dumping, such as 'mimidrv', 'lsass', 'windows\minidump\', 'hiberfil', 'sqldmpr', 'sam', 'ntds.dit', and 'security'. This activity often indicates an attempt to exfiltrate credentials after they have been dumped from a system.
Detects remote credential dumping activity using Impacket's secretdump tool by monitoring SMB file access patterns. Specifically, it looks for access to the ADMIN$ share with paths containing 'SYSTEM32\' and ending with '.tmp', which is characteristic of secretdump creating temporary files during its operation.
Detects potential abuse of ntdsutil or similar methods to dump the ntds.dit database. This activity is often associated with credential dumping from Active Directory.
Detects the creation of files with specific name patterns that are commonly used by tools like Metasploit and Impacket's secretsdump.py to export and stage the NTDS.DIT database for exfiltration. These patterns include '.ntds.cleartext' and 'All.cab', which are indicative of attempts to dump Active Directory credentials.
This rule detects command-line patterns associated with potential Russian APT credential theft activities, specifically targeting Active Directory data. It looks for the use of `xcopy` to copy the `sysvol` directory, which can contain sensitive information, and `adexplorer` to create a snapshot of Active Directory data, typically saved as a `.snp` file in a user's downloads directory. These actions are indicative of adversaries attempting to exfiltrate or analyze Active Directory credentials and configuration.
This rule detects the creation of a file named "ntds.dit", which is the Active Directory database. The NTDS.dit file contains critical information including user credentials (hashed passwords), group memberships, and other Active Directory objects. Adversaries often target this file to dump credentials for lateral movement and privilege escalation within a Windows domain.
This rule detects the creation of files with names commonly associated with credential dumping tools or the output files generated by such tools. This includes executables of known credential dumpers like fgdump, pwdump, cachedump, procdump, and Windows Credential Editor (WCE), as well as output files like 'fgdump-log', 'kirbi', 'pwdump', 'pwhashes', 'wce_ccache', 'wce_krbtkts', 'NTDS.out', 'SAM.out', 'SECURITY.out', and 'SYSTEM.out'.
Detects suspicious process patterns indicative of NTDS.DIT exfiltration attempts. This includes the use of specific tools like NTDSDumpEx, PowerShell scripts (e.g., NTDSgrab.ps1), and command-line utilities (ntdsutil.exe, copy command) to access or copy the ntds.dit file. The rule also looks for these activities originating from suspicious image folders like Apache, Tomcat, AppData, Temp, Public, or PerfLogs.
Detects a command line pattern used by the Conti ransomware group to archive and stage the NTDS.dit database for exfiltration. The rule specifically looks for the execution of '7za.exe' (7-Zip archiver) with a command line that includes '\C$\temp\log.zip', indicating the creation of a zip archive in a temporary location, a common step before exfiltration.
Detects the creation of an 'ntds.dit' file, which contains Active Directory database information including credential hashes, by processes commonly abused by attackers or processes running from suspicious directories like 'Temp' or 'AppData'. This activity is highly indicative of credential dumping attempts.
Detects the creation of the 'ntds.dit' file, which contains Active Directory database information, by processes that are not typically associated with this activity. This rule specifically looks for 'ntds.dit' creation when the parent process is an uncommon executable (e.g., cscript.exe, powershell.exe, web server processes) or originates from suspicious directories (e.g., AppData, Temp, Public). This activity often indicates an attempt to dump Active Directory credentials.
This rule detects attempts to dump the NTDS.dit database to suspicious locations. It specifically looks for ESENT event ID 325 (New Database Created) where the data contains 'ntds.dit' and the path includes common suspicious directories such as Appdata, Desktop, Downloads, Perflogs, Temp, or Users\Public.
Detects the execution of Quarks PwDump, a tool used for dumping credentials, by monitoring process creation events for its executable name and specific command-line arguments. The rule looks for 'QuarksPwDump.exe' and various flags associated with dumping local hashes, domain cached hashes, BitLocker keys, and domain hashes, including those from NTDS files.
Detects the execution of 'ntdsutil.exe', a Windows command-line tool that can be used to perform various operations on the Active Directory database (NTDS.DIT). Adversaries may use this tool to extract credential information or other sensitive data from the NTDS.DIT file.
Page 12 of 14