Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
201 detections
Filters
Last updated
All Time
Detection languages
113
61
11
8
2
Contributors
57
40
32
13
8
Categories
94
86
76
37
36
Platforms
198
5
3
2
1
Products / Services
70
51
41
19
8
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
8
IDS Classtypes
1
1
IDS Protocols
1
1
Detects access to sensitive files, credential data, or remote procedure call (RPC) endpoints related to credential dumping over a network share.
This could indicate lateral movement or remote credential harvesting techniques.
This could indicate lateral movement or remote credential harvesting techniques.
Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
This rule detects the execution of Mimikatz or Mimikatz-related tools and scripts (e.g., DumpCreds, Invoke-Mimikatz, Invoke-Mimikittenz) by analyzing command-line arguments. It specifically looks for the use of various Mimikatz modules and commands, including those related to credential dumping (e.g., sekurlsa::logonpasswords, lsadump::sam, dpapi::masterkey), privilege escalation (e.g., privilege::debug, token::elevate), and other functionalities like Kerberos ticket manipulation (e.g., kerberos::golden, kerberos::ptt).
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Detects chromium-based browsers starting in headless and debugging mode while pointing to a user profile. This behavior can be indicative of data exfiltration, specifically cookie stealing, or remote control of the browser.
Detects attempts to harvest credentials by enabling the RemoteRegistry service or dumping the SAM, SECURITY, or SYSTEM registry hives, which are behaviors associated with the Flax Typhoon APT group.
Detects scenarios where an attacker execute Secretdump in order to remotely dump credentials over SMB.
Detects scenarios where an attacker modifies registry permissions on a local or remote target in order to introduce a backdoor and dump hashes and credentials.
This rule detects the use of 'esentutl.exe' to copy sensitive files containing credential data, such as the Security Account Manager (SAM) database or the NTDS.dit file. It specifically looks for command-line arguments indicative of Volume Shadow Copy operations or direct paths to known sensitive files within the 'config', 'repair', or 'windows\ntds' directories.
This rule detects attempts to transfer sensitive files containing credential data via network shares. It specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) and checks if the 'RelativeTargetName' of the accessed object contains well-known filenames or paths associated with credential storage, such as Mimikatz output, LSASS memory dumps, Windows minidumps, hibernation files, SQL dumps, or critical system files like NTDS.dit, SAM, SECURITY, and SYSTEM hives.
KQL Query from file: Detecting GOLDEN SAML Attack
KQL Query
KQL Query from file: RID Hijacking Technique and Detection
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects well-known credential dumping tools execution via service execution events
The analytic detects the use of PowerShell commands to copy the SAM, SYSTEM, or SECURITY hives, which are critical for credential theft. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This activity is significant as it indicates an attempt to exfiltrate sensitive registry hives for offline password cracking. If confirmed malicious, this could lead to unauthorized access to credentials, enabling further compromise of the system and potential lateral movement within the network.
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Detects well-known credential dumping tools execution via service execution events
In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device.
Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored
Page 5 of 10