Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
68 detections
Filters
Last updated
All Time
Detection languages
38
15
4
4
4
Contributors
36
17
8
3
1
Categories
31
24
17
10
7
Platforms
53
7
3
2
2
Products / Services
10,650
9,755
6,688
4,418
3,745
MITRE Techniques
30
28
20
18
17
CVEs
3
3
2
1
Detects unauthorized processes attempting to open handles to the Local Security Authority Subsystem Service (LSASS) process with access rights consistent with credential dumping (e.g., PROCESS_VM_READ, PROCESS_ALL_ACCESS). This rule also specifically flags the use of well-known tools and techniques such as Mimikatz, ProcDump, and the abuse of rundll32.exe with comsvcs.dll for memory extraction, which is indicative of OS Credential Dumping (T1003.001).
Correlates a sequence of suspicious activities on a single host within 90 minutes: LSASS memory access consistent with credential dumping, followed by remote service or WMI-based lateral movement, and finishing with mass file renames or modifications characteristic of ransomware encryption.
Detects attempts to dump credentials from the Local Security Authority Subsystem Service (LSASS) process memory using common tools like Mimikatz, Procdump, or built-in system utilities such as comsvcs.dll or command-line arguments indicating memory dump operations.
This rule detects potential extraction or caching of Kerberos Ticket-Granting Tickets (TGT) by correlating Kerberos authentication events (4768/4769) with unauthorized access to the Local Security Authority Subsystem Service (lsass.exe). This pattern is often indicative of credential dumping tools like Mimikatz targeting Kerberos tickets on systems potentially used for delegation attacks.
Detects the enabling of the WDigest UseLogonCredential registry value, which forces the storage of plaintext credentials in memory by the LSASS process, followed by a privileged interactive or remote interactive logon on the same host within 72 hours. This sequence suggests an attacker is positioning the system to harvest credentials.
Detects the creation of an LSASS memory dump file (lsass*.dmp) initiated by Task Manager (taskmgr.exe) within Temp or user directories. This behavior often indicates an adversary or unauthorized user leveraging the Task Manager 'Create dump file' feature to dump process memory for credential harvesting.
This rule detects suspicious activity related to the Netlogon service or the LSASS process. It triggers on Netlogon service events (5827, 5828, 5829) which may indicate insecure channel usage or service issues often associated with exploitation, and on Sysmon Event ID 1 where a process is spawned by lsass.exe under the SYSTEM user, a behavior frequently seen during credential dumping or privilege escalation attempts.
This rule monitors for credential dumping activities by identifying the execution of Mimikatz, the use of command-line arguments specific to Mimikatz (e.g., 'sekurlsa'), or unauthorized processes attempting to access the Local Security Authority Subsystem Service (LSASS) process.
This rule detects suspicious activity related to the Netlogon service or the LSASS process. It triggers on Netlogon service events (5827, 5828, 5829) which may indicate insecure channel usage or service issues often associated with exploitation, and on Sysmon Event ID 1 where a process is spawned by lsass.exe under the SYSTEM user, a behavior frequently seen during credential dumping or privilege escalation attempts.
Detects the use of the built-in Windows rundll32.exe utility to call the MiniDump function within comsvcs.dll, a known technique for dumping the memory contents of the Local Security Authority Subsystem Service (LSASS). The rule specifically flags executions that write to the Windows\Temp directory, which is a common indicator of unauthorized credential harvesting attempts.
The rule detects potential credential dumping activities by monitoring for the execution of Mimikatz or the use of its specific command-line arguments (e.g., sekurlsa::logonpasswords, /ntlm:). It also monitors for suspicious, unauthorized processes attempting to open a handle to the LSASS process to access its memory, a common technique for dumping credentials.
Detects the modification of the WDigest 'UseLogonCredential' registry key. Enabling this key forces the WDigest security provider to store plaintext credentials in memory, which is a common technique used by attackers to dump credentials via tools like Mimikatz.
Detects unauthorized access to Windows Credential Manager files, TokenBroker OAuth cache files, or the loading of crypt32.dll from suspicious, user-writable directories (e.g., Temp, Downloads, Desktop) by non-Microsoft or non-system processes. This activity is indicative of credential theft, session hijacking, or attempts to abuse the Windows Data Protection API (DPAPI) to decrypt sensitive local secrets.
Detects unauthorized attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process. The rule monitors for cross-process memory access, the use of legitimate Windows tools like rundll32.exe (loading comsvcs.dll) and procdump.exe for dumping LSASS, and detection of Cobalt Strike-specific command-line patterns related to credential theft.
Detects unauthorized cross-process memory access attempts targeting the Local Security Authority Subsystem Service (lsass.exe). Such attempts are commonly associated with credential dumping techniques to extract credentials from memory.
Detects the use of well-known tools and techniques to dump the memory of the Local Security Authority Subsystem Service (LSASS), which is a common method for harvesting Windows credentials.
Detects unauthorized access to Windows Credential Manager files, TokenBroker OAuth cache files, or the loading of crypt32.dll from suspicious, user-writable directories (e.g., Temp, Downloads, Desktop) by non-Microsoft or non-system processes. This activity is indicative of credential theft, session hijacking, or attempts to abuse the Windows Data Protection API (DPAPI) to decrypt sensitive local secrets.
Detects the modification of the WDigest registry key 'UseLogonCredential' to 1. This configuration forces the Windows LSA process to store plaintext credentials in memory, significantly facilitating credential harvesting techniques such as those employed by Mimikatz.
Detects unauthorized cross-process memory access attempts targeting the Local Security Authority Subsystem Service (lsass.exe). Such attempts are commonly associated with credential dumping techniques to extract credentials from memory.
The rule detects potential credential dumping activities by monitoring for the execution of Mimikatz or the use of its specific command-line arguments (e.g., sekurlsa::logonpasswords, /ntlm:). It also monitors for suspicious, unauthorized processes attempting to open a handle to the LSASS process to access its memory, a common technique for dumping credentials.
Detects unauthorized or suspicious processes attempting to access the memory of the Local Security Authority Subsystem Service (lsass.exe). This activity often indicates attempts to dump process memory to harvest sensitive credentials, a common technique used by attackers to facilitate lateral movement.
Page 1 of 4