Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
201 detections
Filters
Last updated
All Time
Detection languages
113
61
11
8
2
Contributors
57
40
32
13
8
Categories
94
86
76
37
36
Platforms
198
5
3
2
1
Products / Services
70
51
41
19
8
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
8
IDS Classtypes
1
1
IDS Protocols
1
1
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
Detects attempts to access or exfiltrate the Windows Security Account Manager (SAM) or SYSTEM registry hives, which are primary targets for extracting credential hashes. This rule identifies common attack vectors including native Windows registry utilities (reg.exe), PowerShell-based volume shadow copy techniques (Invoke-NinjaCopy), and known credential dumping tools like secretsdump (from the Impacket suite) executed via command line or interpreted through Python.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
This rule detects attempts to acquire Windows credentials by accessing critical registry hives (SAM, SYSTEM, SECURITY) or their shadow copies. It looks for the use of 'reg save' to export hives, as well as direct file access to these hives or their shadow copy variations by non-standard system processes.
Detects the use of the Windows command-line utility 'reg.exe' to query sensitive registry keys or paths commonly associated with credential storage, such as SAM, SECURITY, LSA secrets, or autologon configurations. This activity is often indicative of reconnaissance or credential harvesting attempts.
Detects the use of the Windows command-line utility 'reg.exe' to query sensitive registry keys or paths commonly associated with credential storage, such as SAM, SECURITY, LSA secrets, or autologon configurations. This activity is often indicative of reconnaissance or credential harvesting attempts.
Detects attempts to dump SAM database for local credential extraction
This rule detects when the 'Groups.xml' file within the SYSVOL folder is read. This file can contain sensitive credential information, such as passwords for service accounts, if Group Policy Preferences (GPP) were used to deploy them. Attackers often target this file to extract credentials for privilege escalation or lateral movement.
Detects reg.exe saving the SYSTEM hive to \Windows\Temp\. This activity is often associated with credential dumping techniques where adversaries extract the SAM database for offline cracking.
Detects reg.exe saving the SAM hive directly to \Windows\Temp\, indicative of offline credential cracking.
Detects reading of AutoLogon credentials stored in Winlogon registry key
Detects attempts to dump SAM database for local credential extraction
The rule detects the use of Mimikatz by searching for specific keywords within Windows event logs. These keywords include Mimikatz module commands (e.g., 'dpapi::masterkey', 'kerberos::golden', 'lsadump::', 'sekurlsa::'), artifacts associated with Mimikatz (e.g., 'mimidrv.sys', 'mimilib.dll'), and PowerShell commands commonly used with Mimikatz (e.g., 'Invoke-Mimikatz', 'Invoke-Mimikittenz'). The detection logic specifically excludes events with EventID 15.
Detects inbound RPC calls to the Windows Remote Registry interface using operation numbers associated with registry save/backup operations, which may indicate credential dumping via remote registry access. This rule specifically looks for RPC UUID '338cd001-2244-31f1-aaaa-900038001003' and operation numbers 20 or 31, which correspond to registry save/backup functions.
This rule detects attempts to access the NTDS.dit file or the SYSTEM registry hive, indicated by Security Event ID 4656. Multiple access attempts within an hour are summarized by the subject user name.
This rule detects attempts to access the Security Account Manager (SAM) database remotely over Server Message Block (SMB). It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "\SAM" (case-insensitive) and "NtOpenFile" (case-insensitive). This combination suggests an attempt to open the SAM database file, which could indicate credential access attempts.
This rule detects attempts to dump the Security Account Manager (SAM) hive using the 'reg save' command over HTTP. Specifically, it looks for HTTP requests containing 'reg save' and 'HKLM\SAM' in the URI, indicating an attempt to extract credential information from a Windows system.
This rule detects explicit references to popular PowerShell credential dumping tools, specifically 'Invoke-Mimikatz' and 'Invoke-Kerberoast', within executed PowerShell commands. It leverages native Defender XDR PowerShell command logging to identify these suspicious activities, which are indicative of credential access attempts.
Detects inbound RPC calls to the Windows Remote Registry interface using operation numbers associated with registry save/backup operations, which may indicate credential dumping via remote registry access. This rule specifically looks for RPC UUID '338cd001-2244-31f1-aaaa-900038001003' and operation numbers 20 or 31, which correspond to registry save/backup functions.
This rule detects repeated access attempts (3 or more within an hour) to critical credential storage processes or files, specifically lsass.exe, the Security Account Manager (SAM) database, or the NTDS.dit file. Such activity is indicative of credential theft attempts by an adversary.
Detects the use of reg.exe to save the SAM, SECURITY, or SYSTEM hives to the Temp directory for offline credential cracking, as observed in Seedworm espionage campaigns.
Page 4 of 10