Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
201 detections
Filters
Last updated
All Time
Detection languages
113
61
11
8
2
Contributors
57
40
32
13
8
Categories
94
86
76
37
36
Platforms
198
5
3
2
1
Products / Services
70
51
41
19
8
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
CVEs
8
IDS Classtypes
1
1
IDS Protocols
1
1
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through Windows Registry where the SAM database is stored
Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored
Detect AD credential dumping using impacket secretdump HKTL
Shadow Copies storage symbolic link creation using operating systems utilities
Mimikatz Use
Sigma
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
PowerShell SAM Copy
Sigma
Detects suspicious PowerShell scripts accessing SAM hives
Detects powershell scripts that import modules from suspicious directories
Detection well-known mimikatz command line arguments
Detects the creation of files that look like exports of the local SAM (Security Account Manager)
Detects well-known credential dumping tools execution via service execution events
Detects powershell scripts that import modules from suspicious directories
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory
Detection well-known mimikatz command line arguments
Detects a highly relevant Antivirus alert that reports a password dumper.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Graph of MDO detections trended over time
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through Windows Registry where the SAM database is stored
Shadow Copies creation using operating systems utilities, possible credential access
Detects well-known credential dumping tools execution via specific named pipe creation
lazagne
KQL
This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog.
Ryuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread manually, often on networks that are already infected with Trickbot.
During a typical Ryuk campaign, an operator will use LaZagne, a credential theft tool, to access stored passwords for service accounts. The accounts are then used to jump from desktop clients to servers or domain controllers, allowing for better reconnaissance, faster movement, and a more severe impact on the target.
The following query detects credential theft by LaZagne.
The See also section below lists links to other queries associated with Ryuk ransomware.
References:
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ryuk&threatId=-2147232689
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://github.com/AlessandroZ/LaZagne
Ryuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread manually, often on networks that are already infected with Trickbot.
During a typical Ryuk campaign, an operator will use LaZagne, a credential theft tool, to access stored passwords for service accounts. The accounts are then used to jump from desktop clients to servers or domain controllers, allowing for better reconnaissance, faster movement, and a more severe impact on the target.
The following query detects credential theft by LaZagne.
The See also section below lists links to other queries associated with Ryuk ransomware.
References:
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ryuk&threatId=-2147232689
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://github.com/AlessandroZ/LaZagne
SAM Dump to AppData
Sigma
Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers
Page 6 of 10