Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Amazon GuardDuty detects a brute force activity in an Amazon EC2 or Amazon RDS instance.
Detects a successful attempt to retrieve the service API Keys.
Okta's ThreatInsight can identify multiple login failures with high unknown users count from the same IP across one or more Okta orgs.
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behavior is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
Detects the potential use of Rubeus by identifying the registration of a new trusted logon process. This activity is often associated with Kerberos-related attacks, where Rubeus is used to manipulate Kerberos tickets or processes for privilege escalation or lateral movement.
Detects remote thread creation in the 'mstsc.exe' process by a process originating from a suspicious temporary or public user directory. This technique is often used by attackers to inject code into 'mstsc.exe' to hook APIs and steal credentials during RDP authentications.
This rule detects the GomorrahStealer infostealer by identifying specific bytecode patterns associated with its capabilities. These capabilities include extracting browser autofill data, browser cookies, taking screenshots, gathering antivirus information, and collecting browser history. The rule looks for the presence of all these distinct bytecode signatures within a file to confirm the presence of GomorrahStealer.
Detects the execution of the 'Impersonate' tool, which is designed to manipulate Windows tokens. This tool can be used to escalate privileges by impersonating other user tokens, either remotely (e.g., via PsExec/WmiExec) or interactively. Detection is based on specific command-line arguments or known hashes of the tool.
Detects the execution of the `CreateMiniDump.exe` utility or a process with a specific import hash associated with `CreateMiniDump`, which is used to dump the LSASS process memory for credential extraction. This tool is often used by attackers to bypass antivirus signatures that might detect `mimikatz` or similar tools.
Detects the execution of HandleKatz, a tool designed to dump LSASS memory using cloned handles. The rule identifies the tool by its executable name ('loader.exe'), specific command-line arguments including '--pid:', '--outfile:', and keywords like '.dmp', 'lsass', '.obf', or 'dump', and known IMPHASH values associated with HandleKatz.
Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process with suspicious access masks. Adversaries often target LSASS to dump credentials for lateral movement or privilege escalation. The rule looks for specific access mask values in Windows Security Event IDs 4656 (handle requested) and 4663 (object access attempt) that are indicative of credential dumping activities, while filtering out known legitimate processes.
Detects file access requests to the Windows Sysvol Policies Share by processes that are not commonly expected to interact with these files. This could indicate an adversary attempting to discover or exploit Group Policy Preferences for credential access or other malicious purposes.
Detects the creation of named pipes with patterns characteristic of the EfsPotato privilege escalation tool. This tool exploits a vulnerability related to the Encrypting File System (EFS) service to achieve local privilege escalation by creating specific named pipes for inter-process communication.
This rule detects command-line activity that attempts to access sensitive Microsoft Teams files, specifically the Cookies or Local Storage\leveldb directories. These locations can contain authentication tokens and other sensitive information. The rule specifically looks for processes other than the legitimate Teams.exe accessing these paths, indicating potential credential theft or unauthorized access.
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments. Certipy can be used to enumerate Active Directory Certificate Services (AD CS) for misconfigurations, request certificates, and perform various attacks such as forging authentication certificates (ESC1, ESC2, ESC3, ESC4, ESC6, ESC7, ESC8, ESC9, ESC10). The rule looks for the executable name, original file name, description containing 'Certipy', or specific command-line arguments and flags commonly used by Certipy.
Detects process access requests from known hacktool processes based on their executable names. This rule targets a wide range of tools commonly used for credential dumping, privilege escalation, and other malicious activities, including Mimikatz, various Potato exploits, and other offensive security tools. The detection focuses on the 'SourceImage' field, indicating the process initiating the access.
Detects scriptblock text keywords indicative of potential usage of the tool WinPwn. WinPwn is a tool for Windows and Active Directory reconnaissance and exploitation. The rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' within PowerShell script block logs.
Detects suspicious process access requests to the LSASS process using specific GrantedAccess flags. These flags are often associated with tools and techniques used for credential dumping, such as Mimikatz, by attempting to read or manipulate LSASS memory to extract credentials. The rule includes filters for common legitimate processes like antivirus software, EDRs, and system utilities to reduce false positives.
Detects the creation of files that resemble exports of the local Security Account Manager (SAM) database. This activity is often associated with credential dumping techniques used by adversaries to obtain local user hashes. The rule specifically looks for common filenames and paths used when dumping the SAM hive, including those related to known exploits like CVE-2021-36934 and tools like ShadowSteal and hivenightmare.
Detects suspicious rejected SMB guest logon attempts from an IP address, which can be an indicator of an attempted PrintNightmare (CVE-2021-1675) remote code execution exploit or other brute-force/password guessing attacks against SMB. The rule specifically looks for EventID 31017 (SMB client security event for rejected guest logon) where the UserName is empty and the ServerName starts with '\1', which is often seen in exploit attempts.
Page 196 of 206