Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process. This way we are also able to catch cases in which the attacker has renamed the procdump executable. Procdump dump of lsass using minidump or memory dump options. Covers atomic tests 1 and 8
Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry.
This rule detects processes that query known third-party application registry keys that are known to store credentials. The detection specifically looks for command-line arguments containing paths to registry keys associated with applications like Foxmail, DownloadManager, CoreFTP, IncrediMail, WinSCP, MobaXterm, OpenSSH, OpenVPN, Radmin, Eudora, RealVNC, B2, PuTTY, and TightVNC. This activity often indicates an adversary attempting to discover or extract credentials stored by these applications.
Detects when Kubernetes Secrets are Modified or Deleted.
This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as: A Network Trojan was Detected, Successful Administrator Privilege Gain, Successful User Privilege Gain, Attempt to Login By a Default Username and Password, Known malware command and control traffic, Known malicious file or file based exploit, Known client side exploit attempt, Large Scale Information Leak. These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
Detects LSASS process access requests from a source process with the dump keyword in its image name
Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager
Detects when an account successfully recovers a Local Administrator Password Solution (LAPS) password from Microsoft Entra ID. This activity is logged in Azure audit logs under the 'Device' category with the activity type 'Recover device local administrator password' and additional details indicating 'Successfully recovered local credential by device id'. This event can signify an attacker attempting to gain elevated privileges or maintain persistence by obtaining local administrator credentials.
Detects the execution of RemoteKrbRelay, a tool used for Kerberos relaying attacks. The rule identifies the tool based on its executable name or original filename and various command-line arguments that indicate different Kerberos relaying attack techniques such as relaying to SMB, LDAP for RBCD (Resource-Based Constrained Delegation), changing user passwords, or adding users to groups.
Detect suspicious Kerberos TGT requests.
Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes.
One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus.
This request will generate a 4768 event with some unusual fields depending on the environment.
This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.
Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes.
One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus.
This request will generate a 4768 event with some unusual fields depending on the environment.
This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID. This event can be leveraged by adversaries to obtain crash dumps which may contain sensitive information, including credentials.
Detects failed logon attempts to MSSQL server instances, which can indicate brute-force attacks, password guessing, or credential stuffing attempts against database accounts. This rule specifically looks for Event ID 18456 from MSSQL providers in the Windows Application event log.
This rule detects potential DCShadow attacks by looking for the creation of new Service Principal Names (SPNs) that contain 'GC/' in either Event ID 4742 (A computer account was changed) or Event ID 5136 (A directory service object was modified). DCShadow is a technique used by adversaries to register a rogue Domain Controller and manipulate Active Directory data.
Detects the execution of hacktools developed by 'Cube0x0' by identifying the 'Company' field in the executable's PE metadata. This allows detection even if the tool's filename has been changed. Examples of tools by this author include SharpPrintNightmare, KrbRelay, and SharpMapExec, which are often used for credential access and resource development.
Detects uncommon outbound network activity via Kerberos default port (88) indicating possible lateral movement or initial privilege escalation through delegation. The rule specifically filters out common legitimate processes like LSASS, Chrome, Firefox, and Tomcat that might generate similar network activity, aiming to reduce false positives.
ADFS DKM Key Access
YARA-L
Detects access to the AD contact object to read the AD FS DKM (distributed key manager) master key value
Detects suspicious credential access commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects the execution of the SharpDPAPI tool based on command-line flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project, used for extracting credentials and other sensitive information.
This rule detects the execution of 'BrowserCore.exe' when its filename has been changed from the original. Adversaries may rename this legitimate utility, which is known to be used for extracting Azure tokens, to evade detection. The rule specifically looks for processes where the original filename is 'BrowserCore.exe' but the executed image path does not end with '\BrowserCore.exe'.
This rule detects the execution and usage of the DSInternals PowerShell module. DSInternals is a powerful tool that exposes internal features of Active Directory and Azure Active Directory, enabling actions such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, and recovering Domain Controllers from IFM backups. The rule specifically looks for a wide range of DSInternals cmdlets being executed via the command line.
Page 184 of 206