Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
49 detections
Filters
Last updated
All Time
Detection languages
18
11
7
5
2
Contributors
11
10
6
5
3
Categories
31
24
14
13
10
Platforms
43
7
3
Products / Services
15
11
9
7
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
3
2
2
IDS Protocols
4
3
Detects Active Directory dataset extraction techniques used by MexicanMafia (Operation Escaneo), including ntds.dit access, secretsdump execution, VSS shadow copy abuse, and BloodHound-style AD enumeration for long-term persistence and reconnaissance against critical infrastructure.
Detects Active Directory dataset extraction techniques used by MexicanMafia (Operation Escaneo), including ntds.dit access, secretsdump execution, VSS shadow copy abuse, and BloodHound-style AD enumeration for long-term persistence and reconnaissance against critical infrastructure.
Detects attempts to access or exfiltrate the Windows Security Account Manager (SAM) or SYSTEM registry hives, which are primary targets for extracting credential hashes. This rule identifies common attack vectors including native Windows registry utilities (reg.exe), PowerShell-based volume shadow copy techniques (Invoke-NinjaCopy), and known credential dumping tools like secretsdump (from the Impacket suite) executed via command line or interpreted through Python.
Detects techniques used to extract the Active Directory database (NTDS.dit) for credential dumping. This includes the use of native Windows utilities like ntdsutil.exe, vssadmin.exe, and diskshadow.exe to create volume shadow copies, as well as the identification of ntds.dit files being created or accessed in non-standard locations.
Hunting rule: correlate with additional signals before alerting. Detects PowerShell FileStream open on \\.\<volume> to read raw boot sector bytes.
Hunting rule: correlate with additional signals before alerting. Detects PowerShell FileStream open on \\.\<volume> to read raw boot sector bytes.
This rule detects attempts to perform raw disk access via SSH, specifically looking for the 'dd if=/dev/sd' command within SSH traffic. This activity could indicate an attacker trying to bypass volume-based security controls or exfiltrate data directly from disk partitions.
This rule detects the delivery of a raw volume access tool via HTTP. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "CreateFile", "\\.\", and "GENERIC_READ" within the file data. These strings are indicative of an application attempting to open a raw volume device for direct read access, often a technique used by malware or forensic tools to bypass file system controls.
This rule detects attempts to access physical drives directly over SMB by looking for the string "\\.\PhysicalDrive" in TCP traffic on port 445. This technique can be used by attackers to bypass file system access controls and directly read or write to disk sectors, often as part of defense evasion or data exfiltration.
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Detects the creation or modification of the 'FsTx' directory within 'System Volume Information' on any volume, which is a staging step required by the YellowKey BitLocker bypass (Windows 11, Server 2022/2025). The attacker copies the FsTx folder to either a USB stick's System Volume Information directory OR the target machine's EFI System Partition, then reboots into WinRE while holding CTRL to trigger a shell with unrestricted access to the BitLocker-protected volume. The FsTx folder name has no legitimate use; modifications to System Volume Information by non-system processes are inherently suspicious.
Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts
Detects suspicious process creation activities executed by the SYSTEM user, specifically looking for known malicious programs or command-line parameters often associated with credential dumping, defense evasion, and privilege escalation techniques. This includes the use of tools like Mimikatz, Rubeus, ProcDump, and various PowerShell obfuscation methods, as well as commands related to shadow copy deletion and registry hive saving.
Detects various suspicious activities associated with the HAFNIUM threat group targeting Microsoft Exchange servers. This includes attempts to hide files using `attrib`, scheduled task creation for persistence, execution of an unusual Opera browser, shadow copy enumeration, and data staging/exfiltration using `makecab`, `7zip`, and `rundll32` for minidump creation.
Detects raw disk access attempts by uncommon tools or tools located in suspicious directories. This activity could indicate defense evasion, potentially to bypass file system monitoring or access controls.
This rule detects the use of 'esentutl.exe' to copy sensitive files containing credential data, such as the Security Account Manager (SAM) database or the NTDS.dit file. It specifically looks for command-line arguments indicative of Volume Shadow Copy operations or direct paths to known sensitive files within the 'config', 'repair', or 'windows\ntds' directories.
Detects a variety of post-exploitation techniques observed in attacks leveraging SonicWall vulnerabilities (CVE-2024-40766). These techniques are associated with the Akira ransomware group and include defense evasion, credential access, and data staging.
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts
Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
Robbinhood is ransomware that has been involved in several high-profile incidents, including a 2019 attack on the city of Baltimore, Maryland. Robbinhood operators often employ a distinctive defense evasion technique, where they load a vulnerable driver on to a target and exploit it, in order to turn off security software -- essentially using the driver as malware.
The following query detects a late stage of this technique, when the operator is issuing commands to turn off the driver.
For a query that detects an earlier stage of this technique, see Detect loading of vulnerable drivers by Robbinhood ransomware campaign.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Robinhood.A&ThreatID=2147735370
https://www.nytimes.com/2019/05/22/us/baltimore-ransomware.html
Robbinhood is ransomware that has been involved in several high-profile incidents, including a 2019 attack on the city of Baltimore, Maryland. Robbinhood operators often employ a distinctive defense evasion technique, where they load a vulnerable driver on to a target and exploit it, in order to turn off security software -- essentially using the driver as malware.
The following query detects a late stage of this technique, when the operator is issuing commands to turn off the driver.
For a query that detects an earlier stage of this technique, see Detect loading of vulnerable drivers by Robbinhood ransomware campaign.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Robinhood.A&ThreatID=2147735370
https://www.nytimes.com/2019/05/22/us/baltimore-ransomware.html
Page 2 of 3