Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store. This activity can be indicative of an adversary attempting to steal authentication certificates for various malicious purposes, including lateral movement, persistence, or privilege escalation.
Detects service ticket requests using the weak RC4 encryption type (0x17) for Kerberos, which is often abused in Kerberoasting attacks. The rule specifically looks for Event ID 4769 (A Kerberos service ticket was granted) where the TicketOptions indicate a forwardable and renewable ticket, and the TicketEncryptionType is RC4. It attempts to reduce false positives by excluding service names ending with a dollar sign, which are typically machine accounts.
This rule detects the execution of well-known credential dumping tools by monitoring Windows System event logs for Service Control Manager events (EventID 7045) indicating service creation. The rule specifically looks for service image paths containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This helps identify attempts to install and run these tools as services for credential theft.
Detects attempts to extract credentials from macOS Keychain using the 'security' command-line utility. This rule specifically looks for the use of 'security' with arguments like 'find-certificate', 'export', 'dump-keychain', or 'login-keychain', which are commonly used to access or dump Keychain contents.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory with specific access rights (0x705) and an object type of 'SAM_DOMAIN'. This activity is indicative of tools or techniques used to dump credentials from LSASS, a common method for adversaries to obtain user credentials.
This rule detects the presence of keywords commonly associated with well-known PowerShell exploitation frameworks such as Mimikatz and Metasploit within PowerShell script blocks. The keywords indicate attempts to perform privileged operations like manipulating access tokens, reading process memory, or other actions typically involved in credential dumping and privilege escalation. Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Detects when a process attempts to add or modify a network provider by manipulating the Windows Registry, specifically targeting the 'NetworkProvider' key within 'System\CurrentControlSet\Services\'. This activity is indicative of potential credential dumping attempts, similar to techniques used by tools like NPPSpy, which can register a malicious network provider DLL to capture cleartext credentials during the authentication process.
Detects network access to the 'protected_storage' service, specifically targeting the IPC$ share. This activity is often associated with attempts to extract DPAPI domain backup keys from Domain Controllers, a technique used for credential access and lateral movement.
This rule detects the creation of a remote thread within the KeePass.exe process. This activity is highly suspicious as it can indicate an attacker attempting to inject malicious code into KeePass to extract sensitive information, such as master passwords or stored credentials. This technique is commonly used by tools like KeeFarce and KeeThief for password dumping from KeePass.
Detects when an attacker attempts to add a new network provider by modifying the registry, which can be used to dump clear text credentials. This technique is similar to how tools like NPPSpy operate by registering a malicious network provider DLL to intercept credentials during the authentication process.
This rule detects command-line patterns indicative of reconnaissance activities on Linux systems, specifically searching for '.htpasswd' files which often contain credentials, and files with SUID/SGID permissions ('-perm -4000') which can be exploited for privilege escalation. These commands are commonly used by attackers to gather information about the system's configuration and potential credential storage locations.
Detects attempts to extract the LSA secret DPAPI domain backup key from Domain Controllers. This activity is indicative of an adversary trying to gain access to sensitive cryptographic keys that can be used to decrypt DPAPI-protected data across the domain.
Detects failed Kerberos TGT issue operations. This can be a sign of manipulations of TGT messages by an attacker, potentially indicating attempts to exploit Kerberos for credential access or to bypass authentication mechanisms.
Detects the creation of files with specific name patterns that are commonly used by tools like Metasploit and Impacket's secretsdump.py to export and stage the NTDS.DIT database for exfiltration. These patterns include '.ntds.cleartext' and 'All.cab', which are indicative of attempts to dump Active Directory credentials.
Detects the execution of Certify, a tool used for Active Directory certificate abuse, by identifying its executable name, original file name, description in PE metadata, and specific command-line arguments related to certificate operations such as listing Certificate Authorities (CAs), finding vulnerable templates, requesting, and downloading certificates.
Detects the execution of the KrbRelay tool, a utility used for Kerberos relaying attacks. The rule identifies the tool by its executable name ('KrbRelay.exe') or its original filename, and by specific command-line arguments commonly used by KrbRelay for Kerberos relaying, including parameters related to Service Principal Names (SPN), Class IDs (CLSID), and Resource-Based Constrained Delegation (RBCD) or shadow credentials.
This rule detects command-line patterns associated with potential Russian APT credential theft activities, specifically targeting Active Directory data. It looks for the use of `xcopy` to copy the `sysvol` directory, which can contain sensitive information, and `adexplorer` to create a snapshot of Active Directory data, typically saved as a `.snp` file in a user's downloads directory. These actions are indicative of adversaries attempting to exfiltrate or analyze Active Directory credentials and configuration.
Detects attempts to back up the Data Protection Application Programming Interface (DPAPI) Domain Master Key. This event is generated at the source machine, not the Domain Controller, indicating a potential attempt to gain access to encrypted data.
Detects when the password policy is enumerated on a Windows system. This activity is logged as Event ID 4661, specifically looking for access rights related to 'ReadPasswordParameters' on objects within the 'Security Account Manager'. This can indicate an adversary attempting to gather information about password requirements to aid in further attacks like password guessing or brute-forcing.
Detects when an AWS Elastic Container Service (ECS) Task Definition is created, described, or run, and its container definition includes a command that queries the AWS container credential endpoint. This activity can indicate an adversary attempting to establish persistence or escalate privileges by backdooring task definitions to extract credentials.
This rule detects when an end user grants consent to an application in Azure Active Directory (now Microsoft Entra ID). Specifically, it triggers when the 'ConsentContext.IsAdminConsent' field is 'false', indicating that the consent was given by a regular user rather than an administrator. This activity can be a precursor to adversaries stealing application access tokens by tricking users into authorizing malicious applications.
Page 199 of 206