Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,809 detections
Filters
Last updated
All Time
Detection languages
1,679
1,539
487
304
268
Contributors
834
780
764
414
306
Categories
2,349
1,140
626
566
516
Platforms
3,100
699
579
382
322
Products / Services
855
812
565
421
322
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,809
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
Detects volume shadow copy mount via Windows event log
Detects well-known credential dumping tools execution via service execution events
Detects Access to LSASS Process
Detects remote thread creation by PowerShell processes into "lsass.exe"
Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage.
The process in field Process is the malicious program. A single execution can lead to hundreds of events.
The process in field Process is the malicious program. A single execution can lead to hundreds of events.
Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
Detects files written by the different tools that exploit HiveNightmare
Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file
Detects default lsass dump filename generated by SafetyKatz.
Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials
NTDS.DIT Created
Sigma
Detects creation of a file named "ntds.dit" (Active Directory Database)
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory
Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.
Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes.
Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
Loading unsigned image (DLL, EXE) into LSASS process
Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.
Page 226 of 229