Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the loading of unsigned dbghelp.dll or dbgcore.dll, which are DLLs used for creating memory dumps. This activity is suspicious as these DLLs are often leveraged by attackers, for example, to dump credentials from processes like LSASS using the MiniDumpWriteDump API. Tools like ProcessHacker and the SilentTrinity C2 Framework are known to use this technique.
Detects the loading of DLLs associated with the Time Travel Debugging (TTD) utility. Adversaries can leverage TTD, specifically `tttracer.exe`, to execute malicious processes or dump sensitive process memory, such as that of `lsass.exe`, for credential access. This rule focuses on the dynamic loading of TTD-related DLLs, indicating potential use of the utility.
Detects the execution of PowerShell scripts containing patterns commonly associated with Mimikatz, a tool used for dumping credentials. The rule looks for specific strings related to Mimikatz functionalities like 'DumpCreds', 'DumpCerts', 'sekurlsa::logonpasswords', and 'crypto::certificates' in conjunction with 'CERT_SYSTEM_STORE_LOCAL_MACHINE'.
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass. This technique is often used to extract credentials.
Detects suspicious process patterns indicative of CrackMapExec (CME) being used to dump LSASS credentials. The rule looks for specific command-line arguments used by CME for LSASS dumping, including combinations of 'tasklist' with 'Imagename eq lsass.exe', 'rundll32.exe' with 'comsvcs.dll' and temporary paths, and 'tasklist' with 'findstr /i "lsass"'. These patterns are commonly observed when attackers attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory.
Detects the usage of 'reg.exe' to dump sensitive registry hives, specifically targeting the SAM, SYSTEM, and SECURITY hives. This activity is indicative of credential dumping attempts.
This rule detects the execution of 'rundll32.exe' with specific command-line arguments ('keymgr' and 'KRShowKeyMgr') which indicates an attempt to invoke the Stored User Names and Passwords dialogue, also known as the Key Manager. This activity can be used by adversaries to access or backup stored credentials.
Detects changes to the Windows Registry that configure a monitor program to dump the memory of the lsass.exe process using the SilentProcessExit technique. This method leverages Image File Execution Options (IFEO) to trigger a memory dump of LSASS when it exits, which can be used to extract credentials.
Detects `rundll32.exe` loading a renamed `comsvcs.dll` to dump process memory, which is a common technique for credential dumping, specifically targeting LSASS. The rule looks for `rundll32.exe` executions where the loaded image is NOT the legitimate `comsvcs.dll` (implying a renamed or malicious version).
Detects PowerShell script blocks that contain commands used to export certificates from the local certificate store. This activity can be abused by threat actors to steal private keys from compromised machines.
This rule detects suspicious PowerShell script blocks that contain specific .NET classes often used in LDAP-based credential access attempts. The presence of 'System.DirectoryServices.Protocols.LdapDirectoryIdentifier', 'System.Net.NetworkCredential', and 'System.DirectoryServices.Protocols.LdapConnection' within a PowerShell script block suggests an attempt to interact with an LDAP directory, potentially for password guessing or brute-force attacks against accounts.
Detects the use of 'aspnet_regiis.exe' with specific command-line arguments to decrypt Microsoft IIS connection strings. This activity is indicative of an attacker, potentially with web shell access, attempting to extract sensitive credentials like MSSQL service account passwords from IIS configurations.
Detects the execution of 'ntdsutil.exe' with command-line arguments indicating snapshot operations, specifically mounting a snapshot. This activity can be suspicious as 'ntdsutil.exe' is a legitimate Active Directory diagnostic tool that can be abused by adversaries to extract the NTDS.dit file, which contains sensitive credential information.
Detects calls to PowerShell cmdlets used to export certificates from the local certificate store. Threat actors have been observed abusing this technique to steal private keys from compromised machines, which can then be used for authentication or decryption.
This rule detects attempts to coerce NTLM authentication on the Printer Spooler service, which can be used for privilege escalation. Specifically, it looks for `rundll32.exe` executing with command-line arguments related to `davclnt.dll,DavSetCookie` and keywords like `spoolss`, `srvsvc`, or `/print/pipe/`, indicating an NTLM relay attack against the print spooler service.
Detects the presence of keywords like "lsass" and ".dmp" in the command line, which indicates a potential attempt to dump the LSASS process memory. This technique is commonly used by adversaries to extract credentials.
This rule detects the creation of shadow copies using operating system utilities such as PowerShell, WMIC, or VSSAdmin. Adversaries often create shadow copies to access credential material, specifically the NTDS.dit file or SAM database, for offline analysis. The rule looks for specific executable names combined with command-line arguments containing 'shadow' and 'create'.
Detects suspicious access to Domain Group Policies stored in the SYSVOL share. This rule specifically looks for command-line activity that includes both '\SYSVOL\' and '\policies\', indicating an attempt to interact with Group Policy objects.
Detects the use of esentutl.exe to interact with Volume Shadow Copy Service (VSS) registry keys. This activity can be indicative of attempts to access or dump credentials, particularly from the Security Account Manager (SAM) database, which is often stored in the registry and can be targeted via VSS snapshots.
This rule detects attempts to dump credentials from the Windows Credential Manager using PowerShell. It specifically looks for the use of known PowerShell functions or code patterns associated with credential dumping tools or techniques. This includes functions like 'Get-PasswordVaultCredentials' and 'Get-CredManCreds', as well as the instantiation of .NET objects related to 'Windows.Security.Credentials.PasswordVault' or specific CSharpCodeProvider patterns often used in reflective loading or dynamic compilation for credential access.
This rule detects attempts to enumerate credentials from the Windows Credential Manager using PowerShell. It specifically looks for PowerShell script block text containing both 'vaultcmd' and '/listcreds:', combined with keywords like 'Windows Credentials' or 'Web Credentials'. This activity is indicative of an adversary trying to obtain stored user credentials.
Page 203 of 206