Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
42 detections
Filters
Last updated
All Time
Detection languages
29
9
2
1
1
Contributors
14
13
6
2
2
Categories
17
13
13
11
4
Platforms
42
1
Products / Services
14
11
6
3
3
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
1
IDS Protocols
1
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
This rule detects a sequence of behaviors indicative of credential theft followed by data staging and exfiltration. It identifies processes accessing sensitive browser credentials or KeePass database files, followed by the creation of a ZIP archive within user profile directories, and concludes with an outbound HTTPS connection to a non-trusted, non-Microsoft external destination by the same process.
Detects access to cached domain credentials in the SECURITY registry hive
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
This rule detects the use of password derivation functions (like argon2id, scrypt, pbkdf2) in command lines, which can be indicative of ransomware activity, specifically associated with Prinz Eugen. It focuses on processes like 'servertool.exe', 'encrypt.exe', and 'powershell.exe' initiating these commands.
This rule detects the use of password derivation functions (like argon2id, scrypt, pbkdf2) in command lines, which can be indicative of ransomware activity, specifically associated with Prinz Eugen. It focuses on processes like 'servertool.exe', 'encrypt.exe', and 'powershell.exe' initiating these commands.
This rule detects the execution of processes with command-line arguments indicative of credential theft tools such as Mimikatz, lsadump, sekurlsa, vault, cachedump, or hashdump. It specifically looks for these keywords within Security Event ID 4688 (a process creation event) logs.
This rule detects the execution of processes with command-line arguments indicative of credential theft tools such as Mimikatz, lsadump, sekurlsa, vault, cachedump, or hashdump. It specifically looks for these keywords within Security Event ID 4688 (a process creation event) logs.
This rule detects attempts to access cached domain credentials via the Windows Registry over the SMB protocol (port 445). It specifically looks for the string "SECURITY\Cache" within TCP traffic directed to the HOME_NET on port 445, indicating a potential credential access attempt.
This rule detects the execution of Mimikatz or Mimikatz-related tools and scripts (e.g., DumpCreds, Invoke-Mimikatz, Invoke-Mimikittenz) by analyzing command-line arguments. It specifically looks for the use of various Mimikatz modules and commands, including those related to credential dumping (e.g., sekurlsa::logonpasswords, lsadump::sam, dpapi::masterkey), privilege escalation (e.g., privilege::debug, token::elevate), and other functionalities like Kerberos ticket manipulation (e.g., kerberos::golden, kerberos::ptt).
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Detects usage of "cmdkey.exe" to add generic credentials.
As an example, this can be used before connecting to an RDP session via command line interface.
As an example, this can be used before connecting to an RDP session via command line interface.
Detects usage of cmdkey to look for cached credentials on the system
Detects scenarios where an attacker modifies registry permissions on a local or remote target in order to introduce a backdoor and dump hashes and credentials.
This rule detects the execution of 'cmdkey.exe' with the '-l' argument, which is used to list cached credentials on a Windows system. This activity is often associated with reconnaissance for cached credentials by adversaries.
Detects well-known credential dumping tools execution via service execution events
Detects usage of cmdkey to look for cached credentials on the system
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Detects well-known credential dumping tools execution via service execution events
Page 1 of 2