Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,809 detections
Filters
Last updated
All Time
Detection languages
1,679
1,539
487
304
268
Contributors
834
780
764
414
306
Categories
2,349
1,140
626
566
516
Platforms
3,100
699
579
382
322
Products / Services
855
812
565
421
322
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,809
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
Detects PowerShell calling a credential prompt
Detects PowerShell scripts that contains reference to keystroke capturing functions
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism
Detects execution of a PowerShell script that contains calls to the "Veeam.Backup" class, in order to dump stored credentials.
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.
Detects LSASS process access requests from a source process with the "dump" keyword in its image name.
Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference
Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Detects suspicious process patterns found in logs when CrackMapExec is used
Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool
Detects usage of the Quarks PwDump tool via commandline arguments
Detects the execution of the hacktool SafetyKatz via PE information and default Image name
Detects the execution of SecurityXploded Tools
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Detects process dump via legitimate sqldumper.exe binary
Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Detects the execution of netsh with the "trace" flag in order to start a network capture
Detect the harvesting of wifi credentials using netsh.exe
Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.
Page 227 of 229