Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
781 detections
Filters
Last updated
All Time
Detection languages
351
123
77
74
65
Contributors
208
176
72
63
49
Categories
20,456
11,839
5,876
5,155
4,865
781
Platforms
739
19
17
10
9
Products / Services
277
276
212
90
42
MITRE Techniques
518
373
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects evidence of credential dumping activities, including the execution of known Mimikatz-related binaries or command lines, unauthorized memory dumping of the LSASS process using tools like procdump or rundll32 with comsvcs.dll, and the presence of known credential dumping artifacts on disk. It also monitors cross-process access to lsass.exe by potentially unauthorized or unsigned processes.
This rule detects known credential dumping activity, specifically focusing on the execution of Mimikatz (or renamed variants) and the use of built-in system tools like comsvcs.dll or procdump to dump lsass.exe process memory.
Detects Zerologon exploitation attempts against domain controllers by monitoring for anomalous machine account password resets, execution of known exploitation tooling (e.g., zerologon_tester, secretsdump), and patterns of rapid Netlogon zero-credential authentication failures.
Detects the execution of Rubeus or Mimikatz with command-line arguments indicative of Kerberos attacks such as Pass the Ticket (PtT) or Golden Ticket generation. This rule specifically looks for keywords like 'rubeus ptt', 'kerberos::ptt', 'kerberos::golden', and 'mimikatz kerberos' in process command lines.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects unauthorized attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process. The rule monitors for cross-process memory access, the use of legitimate Windows tools like rundll32.exe (loading comsvcs.dll) and procdump.exe for dumping LSASS, and detection of Cobalt Strike-specific command-line patterns related to credential theft.
This rule monitors for the execution of native Windows utilities (vssadmin.exe, ntdsutil.exe, diskshadow.exe, esentutl.exe) commonly abused by attackers to create volume shadow copies or access the NTDS.dit file for credential dumping or system recovery inhibition.
Detects attempts to dump the memory of the Local Security Authority Subsystem Service (LSASS) process using the built-in Windows comsvcs.dll via rundll32.exe or tasklist commands, a common technique used for credential harvesting.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
Detects the unauthorized use of 'wbadmin.exe' to initiate a backup of Active Directory components (like 'ntds.dit' or the SYSTEM registry hive) when executed from common command-line interpreters (cmd.exe, powershell.exe). The rule correlates this backup activity with subsequent direct file access to sensitive AD database or registry files by processes other than standard system services (e.g., ntds.exe, lsass.exe), often indicative of credential dumping or exfiltration.
Detects a suspicious sequence of adversary behaviors typically associated with pre-ransomware activity. The rule identifies high-volume SMB scanning (more than 20 unique IPs in 5 minutes) correlated with network share discovery (using tools like netscan.exe or PowerShell scripts such as Invoke-ShareFinder), and optionally links these actions to credential dumping events on the same host (LSASS dumping via comsvcs.dll or NTDS.dit exfiltration via wbadmin) within a 48-hour window.
Detects a sequence of events indicative of LSASS memory dumping followed by lateral movement via SMB administrative shares. The rule monitors for suspicious OpenProcess calls targeting lsass.exe, the subsequent creation of dump files in temporary directories, and concurrent access to admin shares (ADMIN$ or C$) from the same host, which is a common pattern for credential harvesting and lateral movement tools like 'lsassy'.
Detects the execution of known Impacket framework scripts such as psexec.py, wmiexec.py, and secretsdump.py, or command lines containing common indicators associated with these tools. The rule monitors process start events and filters for indicators of lateral movement and credential harvesting including administrative share access and lsass or ntds.dit interaction.
Detects unauthorized cross-process memory access attempts targeting the Local Security Authority Subsystem Service (lsass.exe). Such attempts are commonly associated with credential dumping techniques to extract credentials from memory.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects unauthorized or non-standard attempts to replicate directory data from a Domain Controller, specifically looking for Directory Replication Service (DRS) GetChanges and GetChangesAll access requests. This behavior is indicative of a DCSync attack, often used by adversaries to dump credentials from the NTDS.dit database.
Detects the use of the built-in Windows tool 'ntdsutil.exe' to perform an Install from Media (IFM) operation, which creates a copy of the Active Directory database (NTDS.dit). The rule specifically flags when this output is directed to suspicious paths like 'C:\Windows\Temp' or 'C:\Users\Public', which are common locations used by adversaries to stage files for exfiltration.
Detects the use of the built-in Windows tool 'ntdsutil.exe' to perform an Install from Media (IFM) operation, which creates a copy of the Active Directory database (NTDS.dit). The rule specifically flags when this output is directed to suspicious paths like 'C:\Windows\Temp' or 'C:\Users\Public', which are common locations used by adversaries to stage files for exfiltration.
This rule detects common methods used by adversaries to perform credential dumping by accessing the memory of the Local Security Authority Subsystem Service (LSASS). It specifically flags the use of Procdump to create a memory dump of LSASS, the use of the native Windows utility comsvcs.dll via rundll32 to dump process memory, and the creation of LSASS dump files via the Windows Task Manager.
Detects LSASS process memory access for credential dumping
This rule detects the execution of Mimikatz via process name matching or the presence of known credential dumping command-line arguments (e.g., 'sekurlsa::logonpasswords' or 'privilege::debug'). These indicators are commonly used by adversaries to extract sensitive information like plaintext passwords or hashes from the LSASS memory process.
Page 19 of 38