Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
47 detections
Filters
Last updated
All Time
Detection languages
19
11
10
2
2
Contributors
13
11
6
4
3
Categories
33
20
14
10
10
Platforms
46
1
1
Products / Services
19
15
7
4
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
2
IDS Protocols
1
1
Detects Python scripts leveraging secret-tool or DBus on Linux to dump GNOME keyring passwords (UNK_DeadDrop). The rule specifically looks for the 'secret-tool' process being initiated by 'python' or 'python3'.
Detects unauthorized access to Windows Credential Manager vault
This rule detects the delivery of a Windows Credential Manager dump tool over HTTP. It specifically looks for the case-insensitive string "CredEnumerate" within the file data of an HTTP response flowing to the client. This string is indicative of tools designed to interact with or dump credentials from the Windows Credential Manager.
This rule detects attempts to access the Windows Credential Manager Vault remotely over TCP port 445 (SMB). It specifically looks for the string "vaultcmd" in the network traffic, which is a command-line utility used to manage credentials in the Credential Manager. This activity could indicate an attacker attempting to extract stored credentials from a compromised system.
Detects PowerShell script block telemetry (Event ID 4104) containing P/Invoke declarations targeting advapi32.dll's CredEnumerate function or related Credential Manager APIs (CredRead, CredWrite). This technique bypasses standard cmdlets that may be monitored or restricted, providing direct API access to stored Windows credentials including RDP sessions, web service credentials, and enterprise application tokens. Generalizes well beyond specific campaigns to most PowerShell credential-theft families.
Detects the invocation of the Windows Credential Manager interface via rundll32.exe loading keymgr.dll with the KRShowKeyMgr export. This technique is used to view or dump stored credentials and is known to be employed by the Warlock ransomware group during post-exploitation lateral movement.
Detects scenarios where an attacker attempt to dump DPAPI credentials (Windows Vault, Chrome, RDP, WiFi, Emails, ...) or registry hives via network share via tools like DonPAPI.
This analytic detects suspicious loading of the `vaultcli.dll` module by processes executing from publicly writable Windows directories. `vaultcli.dll` is known to be abused by information stealers, such as Meduza, to extract credentials from the Windows Credential Vault. The rule monitors for `ImageLoaded` events (Sysmon EventID 7) where `vaultcli.dll` is loaded by a process whose path is within common temporary, public, or other writable system directories. This behavior indicates potential credential theft attempts by malicious software.
Detects scenarios where an attacker attempts to access vault credentials
This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll and requesting an Entra ID Nonce. More information on the attack scenario this is detection is applicable for can be found in the references.
This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll. More information on the attack scenario this is detection is applicable for can be found in the references.
Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)
List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)
Detects suspicious processes based on name and location that access the Windows Credential Manager and Vault. This activity can be indicative of credential stealing, such as that performed by Mimikatz's "dpapi::cred" function.
This rule detects attempts by uncommon applications to access Windows Data Protection API (DPAPI) Master Keys. Such access can indicate credential theft, for example, through tools like Mimikatz's "dpapi::masterkey" function. The rule specifically looks for file access requests to the DPAPI master key directories for both system and user accounts, while filtering out access from common system and program files locations to reduce false positives.
Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing, for example, the usage of Mimikatz's "dpapi::credhist" function. The rule filters out common legitimate system processes and applications to reduce false positives.
Detects file access requests to the Windows Credential History File by an uncommon application.
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function
Page 2 of 3