Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
781 detections
Filters
Last updated
All Time
Detection languages
351
123
77
74
65
Contributors
208
176
72
63
49
Categories
20,456
11,839
5,876
5,155
4,865
781
Platforms
739
19
17
10
9
Products / Services
277
276
212
90
42
MITRE Techniques
518
373
198
147
103
CVEs
6
4
4
2
1
IDS Classtypes
8
4
4
1
IDS Protocols
10
5
Detects suspicious access to the Local Security Authority Subsystem Service (lsass.exe) process memory, indicated by Sysmon Event ID 10 with an 'UNKNOWN' call trace. This pattern is characteristic of direct syscall usage or memory injection techniques used to bypass standard Windows API hooking and security monitoring, common in credential dumping attempts.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
Detects suspicious access to the Local Security Authority Subsystem Service (lsass.exe) process memory, indicated by Sysmon Event ID 10 with an 'UNKNOWN' call trace. This pattern is characteristic of direct syscall usage or memory injection techniques used to bypass standard Windows API hooking and security monitoring, common in credential dumping attempts.
Detects suspicious access to the Local Security Authority Subsystem Service (lsass.exe) process memory, indicated by Sysmon Event ID 10 with an 'UNKNOWN' call trace. This pattern is characteristic of direct syscall usage or memory injection techniques used to bypass standard Windows API hooking and security monitoring, common in credential dumping attempts.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
Detects a non-system process that allocates executable memory (consistent with custom syscall stub staging) and subsequently opens a handle to the LSASS process. This behavior correlates the preparation of custom syscall stubs (often used to bypass user-mode API hooking) with the direct interaction with LSASS, which is a high-confidence indicator of credential dumping activity.
Detects execution of the macOS 'security' utility to harvest generic or internet passwords from the Keychain, a technique commonly associated with the AMOS (Atomic macOS Stealer) infostealer for credential theft.
Detects modifications to the WDigest UseLogonCredential registry key, which enables the caching of plaintext credentials in LSASS memory. This is a common post-exploitation technique used to facilitate credential theft.
Detects the modification of the WDigest 'UseLogonCredential' registry value to 1 (enabling plaintext credential storage in memory) followed by subsequent access to the LSASS process, a common sequence in credential dumping attacks.
Detects unauthorized access to the LSASS process memory, a common technique for credential harvesting. The rule monitors for the execution of 'procdump.exe' or 'rundll32.exe' with parameters specifically aimed at creating a memory dump of 'lsass.exe', behaviors commonly associated with the SystemBC post-exploitation framework.
Detects the threat actor abusing ntdsutil.exe to create an Install From Media (IFM) dump of the Active Directory database for offline credential cracking.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
Detects unauthorized attempts to extract the Active Directory database (NTDS.dit) for credential harvesting. The rule monitors for common administrative tools like ntdsutil.exe and vssadmin.exe being used to create shadow copies or extract the NTDS database, as well as direct file manipulation of ntds.dit. This activity is often associated with post-exploitation credential dumping techniques.
This rule detects potentially malicious activities on Linux systems involving the creation of new accounts or access to sensitive files like /etc/passwd and /etc/shadow using or referencing the string 'troot'. This pattern is often associated with adversary attempts to create backdoored accounts or perform offline password cracking by manipulating or dumping authentication files.
Detects the use of the native Windows Backup utility (wbadmin.exe) to initiate a backup that specifically includes the Active Directory database file (ntds.dit). This behavior is characteristic of an attempt to perform offline Active Directory credential dumping by creating a backup of the database to an accessible location.
This rule detects an unusually high number of outbound network connections originating from the Local Security Authority Subsystem Service (LSASS) process on a Windows machine. LSASS is a critical system process responsible for enforcing security policy on the system, including user authentication, and typically does not initiate a large number of outbound connections. A high count of outbound connections from LSASS could indicate credential dumping activity, where an attacker is exfiltrating harvested credentials, or other malicious activity compromising the LSASS process.
Detects the use of wbadmin.exe to initiate a system backup that targets sensitive Active Directory and registry files (NTDS.dit, SYSTEM, and SECURITY hives) to a local SMB share on the loopback address. This technique is used by threat actors to stage critical credential material for offline extraction and cracking.
Detects adversary activity consistent with credential dumping tools like KuinaExtractor. The rule monitors for the enumeration of Windows Credential Manager stores using vaultcmd /list or cmdkey /list, and the direct instantiation of the Windows PasswordVault via PowerShell, excluding system accounts and known legitimate applications.
Detects adversary activity consistent with credential dumping tools like KuinaExtractor. The rule monitors for the enumeration of Windows Credential Manager stores using vaultcmd /list or cmdkey /list, and the direct instantiation of the Windows PasswordVault via PowerShell, excluding system accounts and known legitimate applications.
Detects the execution of processes containing command-line arguments associated with the Mimikatz post-exploitation tool, such as credential dumping, privilege escalation, and certificate manipulation keywords.
Detects the execution of processes containing command-line arguments associated with the Mimikatz post-exploitation tool, such as credential dumping, privilege escalation, and certificate manipulation keywords.
Page 21 of 38