Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
53 detections
Filters
Last updated
All Time
Detection languages
20
19
4
3
2
Contributors
13
10
6
3
3
Categories
28
21
10
8
7
Platforms
30
18
5
2
1
Products / Services
10
9
9
5
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
2
IDS Protocols
2
Detects execution of MediaPatcher.app decoy application used for credential harvesting.
Detects attempts to use system dialog prompts to capture user credentials
In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
This rule detects attempts to capture user credentials on macOS by leveraging the `osascript` utility to display system dialog prompts. It specifically looks for `osascript` executions that include commands to 'display dialog' with keywords commonly associated with credential requests, such as 'admin', 'password', 'authenticate', or 'credentials'. This technique can be used by adversaries to present seemingly legitimate pop-ups to trick users into entering their credentials.
The analytic detects a process loading the `credui.dll` or `wincredui.dll` module. This detection leverages Sysmon EventCode 7 to identify instances where these DLLs are loaded by processes outside typical system directories. This activity is significant because adversaries often abuse these modules to create fake credential prompts or dump credentials, posing a risk of credential theft. If confirmed malicious, this activity could allow attackers to harvest user credentials, leading to unauthorized access and potential lateral movement within the network.
Detects when a process loads UIAutomationCore.dll, which may indicate abuse of Microsoft's UI Automation framework. This technique has been observed in Coyote malware for credential theft from banking applications and cryptocurrency exchanges. The rule monitors for processes that load the UI Automation Core library, which enables automated interaction with UI elements.
Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.
Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".
In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
This rule detects the execution of the legitimate tool 'Mouse Lock' based on its product name, company name, or command line arguments. According to Kaspersky's 2020 Incident Response Analyst Report, this tool has been observed being used by adversaries for credential access and data collection in security incidents, making it a potentially unwanted application (PUA) in a security context.
This rule detects when 'credui.dll' or 'wincredui.dll' is loaded by a process that is not commonly associated with these DLLs. Attackers might load these DLLs to interact with Windows Credential Provider functions like 'CredUIPromptForCredentials' or 'CredUnPackAuthenticationBufferW' to prompt users for credentials or extract them.
Page 3 of 3