Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
781 detections
Filters
Last updated
All Time
Detection languages
351
123
77
74
65
Contributors
208
176
72
63
49
Categories
20,456
11,839
5,876
5,155
4,865
781
Platforms
739
19
17
10
9
Products / Services
277
276
212
90
42
MITRE Techniques
518
373
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
This rule detects potentially malicious activities aimed at credential harvesting and system recovery inhibition. It monitors for the execution of vssadmin.exe with arguments to list shadow copies (often a precursor to deletion) or references to DPAPI master keys in command lines. Additionally, it identifies unauthorized processes attempting to access sensitive browser-based credential files (e.g., Login Data, Cookies, key4.db) from standard browser installation paths, specifically excluding legitimate browser and update processes.
Detects unauthorized attempts to exercise Active Directory replication rights (DS-Replication-Get-Changes). This occurs when non-machine accounts access specific control access rights (GUIDs 1131f6aa, 1131f6ad, or 89e95b76) on a domain controller, a common indicator of a DCSync attack used to extract password hashes from Active Directory.
This rule detects potential credential theft activity by monitoring for unauthorized access to sensitive browser-related credential files (e.g., Login Data, cookies.sqlite) or direct access to the LSASS process memory by non-standard browser processes. It further correlates these events with user sign-ins on previously unknown or unassociated devices within a short timeframe to identify potential account compromise.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects offreg.dll (Windows Offline Registry Library) being loaded by a process running outside the standard System32/SysWOW64 directories and that is not a known Windows registry-management host process, excluding Malwarebytes' own bundled private copy of the DLL. PrettyPrague uses this library to read the SAM/LSA hive and derive boot-key material outside normal registry API paths. Scoped to the loading process's directory and identity rather than any specific PoC binary name.
Detects direct file access attempts to critical Windows registry hive files (SAM, SECURITY, SYSTEM, SOFTWARE) on disk. These files contain sensitive system and credential information, and direct access is frequently used by adversaries to perform offline credential dumping.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects access to the SAM registry hive or SAM-related LSA control keys initiated by a process associated with the Avast Sandbox component rather than LSASS or an administrative security tool. The PrettyPrague PoC abuses a vulnerability in Avast Sandbox to dump the SAM database and spawn a SYSTEM shell, so SAM hive reads originating from the sandbox component itself are anomalous.
Detects unauthorized attempts to dump the process memory of the Local Security Authority Subsystem Service (LSASS), a common technique used by attackers to harvest credentials from memory. This includes the use of legitimate diagnostic tools like procdump and comsvcs.dll, as well as the identification of resulting dump files in directory paths associated with LSASS.
This rule detects instances where a process loads 'offreg.dll' (Offline Registry Library) and concurrently accesses the SAM (Security Account Manager) file. This is a common technique used by attackers to offline-extract local account hashes without using standard registry tools, potentially bypassing basic monitoring of 'reg.exe'.
Detects unauthorized attempts to dump the process memory of the Local Security Authority Subsystem Service (LSASS), a common technique used by attackers to harvest credentials from memory. This includes the use of legitimate diagnostic tools like procdump and comsvcs.dll, as well as the identification of resulting dump files in directory paths associated with LSASS.
Detects anomalous access to specific registry keys under SYSTEM\CurrentControlSet\Control\Lsa that are associated with LSA secrets. The rule monitors for multiple registry operations (set, create, delete) performed by processes other than standard Windows system processes (lsass.exe, svchost.exe, winlogon.exe, services.exe), which is often indicative of credential dumping attempts.
Detects unauthorized attempts to dump the process memory of the Local Security Authority Subsystem Service (LSASS), a common technique used by attackers to harvest credentials from memory. This includes the use of legitimate diagnostic tools like procdump and comsvcs.dll, as well as the identification of resulting dump files in directory paths associated with LSASS.
Detects the use of the native Windows utility 'wbadmin.exe' to initiate a backup procedure targeting the Active Directory database (NTDS.dit) and associated registry hives (SYSTEM, SECURITY). This technique is utilized by adversaries for offline credential harvesting by extracting the directory database file. This behavior has been observed in intrusion campaigns involving ransomware actors like Akira.
Detects the use of rundll32.exe to invoke the MiniDump export function of comsvcs.dll to create a memory dump of the LSASS process. This technique is often associated with post-exploitation credential access tools like lsassy or manual execution via remote management tools (e.g., WMI, MMC) by threat actors such as those in the Bumblebee/Akira ransomware intrusion chain.
This rule detects the use of the 'security' command-line utility on macOS to access or dump contents from the login keychain, specifically targeting the 'login.keychain-db' file or attempting to retrieve generic passwords. This behavior is indicative of credential access attempts where an adversary is trying to extract sensitive information, such as passwords or keys, stored within the macOS Keychain.
This rule detects the use of the 'security' command-line utility on macOS to access or dump contents from the login keychain, specifically targeting the 'login.keychain-db' file or attempting to retrieve generic passwords. This behavior is indicative of credential access attempts where an adversary is trying to extract sensitive information, such as passwords or keys, stored within the macOS Keychain.
Page 12 of 38