Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
339 detections
Filters
Last updated
All Time
Detection languages
120
95
28
25
18
Contributors
111
38
29
22
22
Categories
227
127
107
45
27
Platforms
254
58
57
11
10
Products / Services
76
70
29
21
17
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
2
1
1
1
IDS Classtypes
7
1
IDS Protocols
8
'This query identifies when a new trust monitor event is detected.'
This rule detects suspicious command-line activity indicative of credential access or reconnaissance, as outlined in a CISA 'Living off the Land' report. Specifically, it looks for commands that attempt to list SSH known hosts, access Firefox profiles, execute Mimikatz, query OpenSSH or RealVNC registry keys, or save SAM/SYSTEM registry hives. While individual commands might be benign, their combined presence or repeated execution could signal malicious intent.
This rule detects the creation of files with specific naming conventions and extensions that are indicative of exported or stolen DPAPI backup keys and certificates. These patterns are commonly associated with tools like Mimikatz and DSInternals, which adversaries use to extract credentials and cryptographic material from Windows systems. The rule looks for filenames containing "ntds_capi_", "ntds_legacy_", or "ntds_unknown_" and ending with ".cer", ".key", ".pfx", or ".pvk".
Detects file access requests to browser credential stores by uncommon processes. This could indicate a potential attempt at credential stealing. This rule requires heavy baselining before usage.
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
Detects suspicious credential access commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
The following analytic detects the execution of the Windows OS tool cmdkey.exe, which is often abused by post-exploitation tools like winpeas, commonly used in ransomware attacks to list stored usernames, passwords, or credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant as it indicates potential credential harvesting, which can lead to privilege escalation and persistence. If confirmed malicious, attackers could gain unauthorized access to sensitive information and maintain control over compromised systems for further exploitation.
This analytic detects the execution of the Windows OS tool cmdkey.exe with the /delete parameter. This activity is significant because cmdkey.exe can be used by attackers to delete stored credentials, potentially leading to privilege escalation and persistence. If confirmed malicious, this behavior could allow attackers to remove stored user credentials, hindering incident response efforts and enabling further unauthorized access to the compromised system.
The following analytic detects the execution of the Windows OS tool cmdkey.exe, which is used to create stored usernames, passwords, or credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because cmdkey.exe is often abused by post-exploitation tools and malware, such as Darkgate, to gain unauthorized access. If confirmed malicious, this behavior could allow attackers to escalate privileges and maintain persistence on the targeted host, facilitating further attacks and potential data breaches.
Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance using the GetPasswordData API call in AWS CloudTrail. This action indicates an adversary is attempting to gain access to credentials for a Windows virtual machine.
This rule detects when AWS API Gateway keys are accessed with the 'includeValue' or 'includeValues' parameter set to 'true'. This indicates an attempt to retrieve the actual API key values, which could be a credential access attempt. The rule specifically looks for 'GetApiKey' and 'GetApiKeys' events in AWS CloudTrail logs where the request explicitly asks for the key's value.
Detects a successful attempt to retrieve service API Keys within Google Cloud Platform. This activity could indicate an attacker attempting to gain access to sensitive credentials for further malicious actions.
Detects when AWS API Gateway keys are accessed.
Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance.
Detects a successful attempt to retrieve the service API Keys.
Detects command-line keywords indicative of the execution of the WinPwn tool, which is used for Windows and Active Directory reconnaissance and exploitation. This rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' in the command line.
Detects scriptblock text keywords indicative of potential usage of the tool WinPwn. WinPwn is a tool for Windows and Active Directory reconnaissance and exploitation. The rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' within PowerShell script block logs.
This rule detects attempts to dump credentials from the Windows Credential Manager using PowerShell. It specifically looks for the use of known PowerShell functions or code patterns associated with credential dumping tools or techniques. This includes functions like 'Get-PasswordVaultCredentials' and 'Get-CredManCreds', as well as the instantiation of .NET objects related to 'Windows.Security.Credentials.PasswordVault' or specific CSharpCodeProvider patterns often used in reflective loading or dynamic compilation for credential access.
This rule detects attempts to enumerate credentials from the Windows Credential Manager using PowerShell. It specifically looks for PowerShell script block text containing both 'vaultcmd' and '/listcreds:', combined with keywords like 'Windows Credentials' or 'Web Credentials'. This activity is indicative of an adversary trying to obtain stored user credentials.
Detects the execution of tools from SecurityXploded, specifically focusing on 'PasswordDump.exe'. These tools are often used for credential dumping, which involves extracting credentials from various password stores on a system.
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Page 16 of 17