Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
274 detections
Filters
Last updated
All Time
Detection languages
116
97
21
13
9
Contributors
57
50
47
36
28
Categories
163
147
109
63
38
Platforms
268
6
4
1
1
Products / Services
98
88
48
25
19
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects the use of the built-in Windows tool 'wbadmin.exe' to perform a system backup that specifically includes the Active Directory database (ntds.dit) along with SYSTEM and SECURITY registry hives. This technique is often used by adversaries to perform offline credential theft by creating an accessible copy of sensitive domain files.
Detects the execution of FTK Imager.exe followed by the creation of the Active Directory database (NTDS.dit) and at least one critical Windows registry hive file (SAM, SYSTEM, or SECURITY) in the user's Downloads folder within a 30-minute timeframe. This pattern is indicative of potential credential theft or offline password cracking attempts using forensic imaging utilities.
Detects the execution of the LimeWire P2P file-sharing application within 30 minutes of the creation of sensitive files, such as LSASS memory dumps, NTDS.dit, or SAM/SYSTEM/SECURITY registry hives, on the same host. This temporal correlation suggests the potential exfiltration of sensitive credential material via P2P file-sharing.
Detects multiple stages of the ChocoShell credential and token theft framework, including SYSTEM token impersonation for DPAPI key access, VSS shadow copy abuse to extract browser databases, malicious use of browser remote debugging ports (CDP) for cookie exfiltration, and unauthorized access to browser profile files or Token Broker cache (.tbres) files.
Detects unauthorized or unprivileged user-mode processes attempting to access files within Volume Shadow Copy paths. This behavior is indicative of reconnaissance or exploit techniques such as those observed in the RoguePlanet framework, where attackers enumerate snapshots to resolve stable file paths for subsequent malicious activity.
Detects various indicators of credential dumping associated with Mimikatz and manual extraction of the Active Directory database (NTDS.dit). This includes execution of Mimikatz, use of specific modules like lsadump::dcsync and sekurlsa::logonpasswords, direct access to the LSASS process, and usage of ntdsutil or vssadmin to create shadow copies for NTDS.dit file access.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
Detects instances where the Windows Error Reporter (wermgr.exe) process attempts to open a handle to a Volume Shadow Copy (VSS) device. This behavior is anomalous as legitimate VSS operations are typically performed by dedicated system processes (e.g., vssvc.exe, diskshadow.exe), and such access by wermgr.exe may indicate an attempt to bypass file locks for credential dumping or sensitive data exfiltration.
Detects potential credential dumping activity targeting sensitive files like NTDS.dit, SAM, and SYSTEM hives. This rule monitors for three primary indicators: unauthorized invocation of vssuirun.exe (often used for Volume Shadow Copy manipulation), exploitation of print command utilities to access sensitive system files, and the staging of critical credential files into temporary directory paths.
Detects attempts to access or copy the Active Directory domain database (NTDS.dit), which contains sensitive credential material. The rule monitors for the use of built-in administrative tools such as esentutl, ntdsutil, vssadmin, and wbadmin, as well as file copy utilities (robocopy, xcopy) when specifically targeting the NTDS directory or volume shadow copies containing the database file.
This rule detects attempts to access the NTDS.dit file or the SYSTEM registry hive, indicated by Security Event ID 4656. Multiple access attempts within an hour are summarized by the subject user name.
Detects instances where the Active Directory domain database file (ntds.dit) is accessed by processes other than known legitimate tools such as lsass.exe or ntdsutil.exe. This activity is a strong indicator of credential dumping attempts to extract Active Directory hashes.
Detects instances where the Windows Error Reporting process (wermgr.exe) attempts to open files located within a Volume Shadow Copy path. This behavior is atypical and may indicate an attempt to access sensitive files from a shadow copy, a technique often used in credential dumping or discovery activities.
Detects the use of legitimate Windows system utilities (ntdsutil.exe, vssadmin.exe, esentutl.exe) to interact with the Active Directory database file (ntds.dit). This behavior is commonly associated with offline credential harvesting, where an attacker attempts to create a copy of the database to extract hashes offline.
This rule detects various methods used to copy or access the Active Directory database (NTDS.dit), a common technique used by attackers to dump domain credentials. The rule monitors for the use of ntdsutil with 'ifm' (install from media) arguments, vssadmin to create volume shadow copies of the NTDS file, esentutl directly interacting with the NTDS database path, and common file copy utilities attempting to copy the NTDS.dit file.
This rule detects suspicious activity associated with potential threat actor staging patterns, specifically monitoring for the usage of temporary directories like 'wdtest_temp', file path manipulation involving 'RP_*' (often related to shadow copy or system restore point paths), and the execution of 'wermgr.exe' from non-standard locations. It also identifies non-SYSTEM processes attempting to enumerate Volume Shadow Copy Service (VSS) devices using commands like 'NtQueryDirectoryObject' or referencing 'HarddiskVolumeShadowCopy'.
This rule detects when critical Windows services or processes associated with Active Directory (NTDS, Netlogon, LSASS, LDAP) or the Print Spooler (Spooler, spoolsv.exe) crash multiple times (3 or more) on a machine within a 7-day period. This could indicate instability, a denial-of-service attempt, or a system compromise affecting core services.
Detects the use of the Windows Backup utility (wbadmin.exe) to initiate a backup targeting critical Active Directory or system configuration files (ntds.dit, SYSTEM, or SECURITY registry hives). This behavior is often associated with credential dumping, where adversaries attempt to extract the AD database by utilizing built-in Windows backup tools to create a copy that can then be exfiltrated or processed offline.
Detects the execution of wbadmin.exe to initiate a backup that specifically targets the NTDS.dit database and registry hives (SYSTEM, SECURITY), then stages them to a path on C:\ProgramData. This pattern is characteristic of credential dumping activities associated with the Akira ransomware, enabling offline extraction of domain credentials.
Detects unauthorized access to the Active Directory database (NTDS.dit) or registry hives (SYSTEM, SECURITY) using native Windows utilities like wbadmin.exe and ntdsutil.exe. This activity is indicative of credential dumping and staging efforts for exfiltration, as observed in Akira ransomware campaigns.
This rule detects suspicious SMB traffic targeting raw disk volumes (e.g., PhysicalDrive, C:) or sensitive Windows files such as NTDS.dit and SYSTEM hive files. This behavior is indicative of credential dumping attempts, often performed using tools like secretsdump.py or Invoke-NinjaCopy, which bypass standard file system access controls to exfiltrate critical system credentials.
Page 4 of 14