Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
49 detections
Filters
Last updated
All Time
Detection languages
18
11
7
5
2
Contributors
11
10
6
5
3
Categories
31
24
14
13
10
Platforms
43
7
3
Products / Services
15
11
9
7
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
3
2
2
IDS Protocols
4
3
This rule detects attempts to extract the ntds.dit file, which contains Active Directory credential information, using `wmic` in conjunction with `vssadmin.exe` or `ntdsutil.exe`. It also identifies the creation of `.dit` files in temporary directories and specific ESENT application event logs associated with NTDS database activity. This activity is indicative of credential dumping, a common post-exploitation technique.
The analytic detects the creation of shadow copies using `vssadmin.exe` or `wmic.exe`. This activity is significant because creating shadow copies can be a precursor to ransomware attacks or data exfiltration, allowing attackers to bypass file locks and access sensitive data. If confirmed malicious, this behavior could enable attackers to maintain persistence, recover deleted files, or prepare for further malicious activities, posing a significant risk to the integrity and confidentiality of the system. Adversaries may create shadow copies to access the NTDS.dit file for credential dumping or to exfiltrate data.
Detects a command used by the Conti ransomware group to list volume shadow copies and redirect the output to a log file. This activity is often a precursor to deleting shadow copies to prevent system recovery.
This rule detects PowerShell scripts attempting to open a handle to a drive volume using the `IO.FileStream` object and the `\\.\` DOS device path specifier. This technique is often used for direct access to the volume, bypassing standard file system controls.
This rule detects the creation of shadow copies using operating system utilities such as PowerShell, WMIC, or VSSAdmin. Adversaries often create shadow copies to access credential material, specifically the NTDS.dit file or SAM database, for offline analysis. The rule looks for specific executable names combined with command-line arguments containing 'shadow' and 'create'.
Detects the use of esentutl.exe to interact with Volume Shadow Copy Service (VSS) registry keys. This activity can be indicative of attempts to access or dump credentials, particularly from the Security Account Manager (SAM) database, which is often stored in the registry and can be targeted via VSS snapshots.
Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.
Page 3 of 3