Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
275 detections
Filters
Last updated
All Time
Detection languages
117
97
21
13
9
Contributors
57
50
47
36
28
Categories
164
147
110
63
38
Platforms
269
6
4
1
1
Products / Services
98
88
48
25
19
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects the execution of 'ntdsutil.exe' with command-line arguments indicating snapshot operations, specifically mounting a snapshot. This activity can be suspicious as 'ntdsutil.exe' is a legitimate Active Directory diagnostic tool that can be abused by adversaries to extract the NTDS.dit file, which contains sensitive credential information.
This rule detects the creation of shadow copies using operating system utilities such as PowerShell, WMIC, or VSSAdmin. Adversaries often create shadow copies to access credential material, specifically the NTDS.dit file or SAM database, for offline analysis. The rule looks for specific executable names combined with command-line arguments containing 'shadow' and 'create'.
Detects a command that accesses the Volume Shadow Copy to extract sensitive files such as the Security or SAM registry hives or the Active Directory database (ntds.dit). This activity is often associated with credential dumping.
This rule detects the creation of a symbolic link (symlink) to a Volume Shadow Copy using the 'mklink' command-line utility. Adversaries often create symlinks to shadow copies to access and exfiltrate sensitive data, such as credential hashes from the Security Account Manager (SAM) database or the Active Directory database (NTDS.dit), without directly interacting with the live system files. This technique is commonly used as part of credential dumping activities.
Detects the execution of 'ditsnap.exe', a tool used to inspect the Active Directory database (ntds.dit). This tool can be used by adversaries to dump credentials from a domain controller.
Detects suspicious invocation of the Get-ADDBAccount PowerShell script that reads from an ntds.dit file. This technique can be used to gain access to credentials without relying on traditional credential dumping tools. The rule specifically looks for the presence of 'Get-ADDBAccount', 'BootKey', and 'DatabasePath' in the PowerShell payload, indicating an attempt to extract credentials from an NTDS database file.
This rule detects the use of the built-in Windows 'copy' command via 'cmd.exe' to transfer files with '.dmp', '.dump', or '.hdmp' extensions from a remote network share (indicated by '\\') to a local system. This activity is often associated with credential dumping techniques where memory dumps (e.g., LSASS process memory dumps) containing sensitive information are exfiltrated or staged.
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
Ntdsutil Abuse
Sigma
Detects potential abuse of ntdsutil to dump ntds.dit database
Detect AD credential dumping using impacket secretdump HKTL
NTDS.DIT Created
Sigma
Detects creation of a file named "ntds.dit" (Active Directory Database)
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory
Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.
Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers
Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.
Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)
Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.
Files with well-known filenames (sensitive files with credential data) copying
Shadow Copies storage symbolic link creation using operating systems utilities
Page 13 of 14