Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
10
2
1
1
Contributors
5
5
3
1
Categories
7
4
3
2
2
Platforms
13
1
Products / Services
3
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects installation of password filter DLLs to intercept plaintext passwords
Detects installation of password filter DLLs to intercept plaintext passwords
This rule detects network traffic on TCP port 445 (SMB) containing the string "Notification Packages" in a case-insensitive manner, flowing to the server. This pattern is indicative of an attempt to install a password filter DLL for credential harvesting, a technique used by attackers to capture user credentials.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS
This rule detects PowerShell commands that attempt to copy files into critical Windows system directories like "System32" or "SysWOW64". This activity can be indicative of persistence mechanisms, defense evasion, or credential access attempts, such as installing a malicious password filter DLL.
Detects the modification of the Local Security Authority (LSA) configuration to register a malicious password filter DLL. This is achieved by looking for command-line arguments that attempt to add or modify registry keys under 'HKLM\SYSTEM\CurrentControlSet\Control\Lsa' related to password filters, specifically involving 'scecli' and 'reg add'. This technique is often used by adversaries to harvest credentials.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS
Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"
Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"