Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
142 detections
Filters
Last updated
All Time
Detection languages
51
40
14
10
8
Contributors
37
32
17
10
9
Categories
94
71
28
19
16
Platforms
140
8
2
2
Products / Services
88
82
14
7
5
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
3
1
IDS Classtypes
2
1
1
IDS Protocols
4
2
Detects various indicators of credential dumping associated with Mimikatz and manual extraction of the Active Directory database (NTDS.dit). This includes execution of Mimikatz, use of specific modules like lsadump::dcsync and sekurlsa::logonpasswords, direct access to the LSASS process, and usage of ntdsutil or vssadmin to create shadow copies for NTDS.dit file access.
This rule detects command-line arguments and file names associated with the execution of Mimikatz or derived tools (such as SafetyKatz). It monitors for specific modules and flags, including credential harvesting (sekurlsa, lsadump, vault), DPAPI operations, and Kerberos manipulation, which are characteristic of adversary credential theft and privilege escalation activities.
Detects the execution of Mimikatz specifically utilizing the lsadump::dcsync command or the internal DRSGetNCChanges function call. These behaviors are indicative of an adversary performing directory replication abuse against a Domain Controller to extract sensitive Active Directory credentials, including password hashes.
Detects anomalous network traffic patterns characteristic of the Mimikatz 'lsadump' module performing a DCSync attack. The rule monitors for DRSUAPI (Directory Replication Service Remote Protocol) RPC requests, specifically the DsGetNCChanges operation, which is abused to synchronize Active Directory data including sensitive password hashes.
This rule detects potential DCSync replication abuse by monitoring Security Event ID 4662, specifically looking for access to 'domainDNS' or user objects with the GUID '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2', which is associated with Directory Replication Service (DRS) permissions. It filters out machine accounts to reduce false positives.
This rule detects various methods used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to extract credentials. It monitors for suspicious Process Access (EventCode 10) with sensitive access masks, as well as Process Creation (EventCode 1) and Image Load (EventCode 7) events associated with known credential dumping tools like Mimikatz and legitimate system tools misused for dumping memory such as Procdump and comsvcs.dll.
Detects a sequence of events where a user performs a network logon (Event ID 4624, Logon Type 3) followed by a successful Directory Replication Service (DRS) request (Event ID 4662, Access Mask 0x100) on a Domain Controller within a one-hour window. This pattern is indicative of potential lateral movement followed by credential dumping via DCSync, often associated with tools like Mimikatz.
Detects anomalous network traffic patterns characteristic of the Mimikatz 'lsadump' module performing a DCSync attack. The rule monitors for DRSUAPI (Directory Replication Service Remote Protocol) RPC requests, specifically the DsGetNCChanges operation, which is abused to synchronize Active Directory data including sensitive password hashes.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
This rule detects potential DCSync replication abuse by monitoring Security Event ID 4662, specifically looking for access to 'domainDNS' or user objects with the GUID '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2', which is associated with Directory Replication Service (DRS) permissions. It filters out machine accounts to reduce false positives.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
Detects DCSync attacks abusing the directory replication (DRSUAPI) interface by auditing Windows Security Event 4662. The rule monitors for access to directory replication extended rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All) on the domainDNS object, specifically excluding machine accounts and built-in service accounts to reduce noise. This behavior is indicative of unauthorized credential harvesting from Active Directory.
This rule detects multiple attempts by a user account to perform a Directory Synchronization (DirSync) operation, which is a common indicator of a DCSync attack. The rule specifically looks for Event ID 4662 with properties containing 'DS-DirSync' or '131072', filters for user accounts, excludes known service accounts, and triggers if there are 5 or more attempts from the same account and computer.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
Detects unauthorized or non-standard attempts to replicate directory data from a Domain Controller, specifically looking for Directory Replication Service (DRS) GetChanges and GetChangesAll access requests. This behavior is indicative of a DCSync attack, often used by adversaries to dump credentials from the NTDS.dit database.
Detects sensitive Active Directory replication operations (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All) initiated by accounts other than standard domain controllers. This behavior is a common indicator of DCSync attacks, where an adversary mimics a domain controller to request sensitive Active Directory data, such as password hashes, from a legitimate domain controller.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) related to Directory Replication (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All GUIDs) originating from non-domain controller accounts. This identifies unauthorized attempts to replicate Active Directory password data.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
This rule detects activities associated with credential dumping, specifically targeting techniques that abuse the Directory Replication Service (DRS) protocol, such as DCSync or the use of tools like secretsdump. It monitors both process execution command lines and network traffic for keywords indicative of these credential extraction behaviors, which are commonly used by attackers to obtain domain credentials.
Page 4 of 7