Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,809 detections
Filters
Last updated
All Time
Detection languages
1,679
1,539
487
304
268
Contributors
834
780
764
414
306
Categories
2,349
1,140
626
566
516
Platforms
3,100
699
579
382
322
Products / Services
855
812
565
421
322
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,809
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects well-known credential dumping tools execution via service execution events
Detects a dump file written by QuarksPwDump password dumper
Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.
Detects well-known credential dumping tools execution via specific named pipe creation
Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.
Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share
Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.
Detects the use of KrbRelay, a Kerberos relaying tool
Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera
Detects service principal name (SPN) enumeration used for Kerberoasting
List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Identifies when a Keyvault Key is modified or deleted in Azure.
Identifies when secrets are modified or deleted in Azure.
Detects when highly privileged delegated permissions are granted on behalf of all users
Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.
Page 224 of 229