Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
274 detections
Filters
Last updated
All Time
Detection languages
116
97
21
13
9
Contributors
57
50
47
36
28
Categories
163
147
109
63
38
Platforms
268
6
4
1
1
Products / Services
98
88
48
25
19
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
This rule detects attempts to acquire Windows credentials by accessing critical registry hives (SAM, SYSTEM, SECURITY) or their shadow copies. It looks for the use of 'reg save' to export hives, as well as direct file access to these hives or their shadow copy variations by non-standard system processes.
Detects the use of legitimate Windows system utilities (ntdsutil.exe, vssadmin.exe, esentutl.exe) to interact with the Active Directory database file (ntds.dit). This behavior is commonly associated with offline credential harvesting, where an attacker attempts to create a copy of the database to extract hashes offline.
This rule detects various methods used to copy or access the Active Directory database (NTDS.dit), a common technique used by attackers to dump domain credentials. The rule monitors for the use of ntdsutil with 'ifm' (install from media) arguments, vssadmin to create volume shadow copies of the NTDS file, esentutl directly interacting with the NTDS database path, and common file copy utilities attempting to copy the NTDS.dit file.
Detects the use of native Windows utilities (vssadmin, ntdsutil, diskshadow, esentutl) or command-line execution (cmd, powershell) to access, copy, or create shadow copies of the Active Directory database file (NTDS.dit), which is a common indicator of credential dumping.
Detects various techniques used to extract the Active Directory NTDS.dit database on Windows. The rule monitors for the misuse of administrative tools including ntdsutil.exe (for IFM or instance activation), vssadmin.exe (to create volume shadow copies as a prerequisite), and esentutl.exe (for direct ESE database operations). The detection focuses on suspicious command-line patterns indicative of credential dumping attempts.
Detects the use of the native Windows wbadmin.exe utility to initiate a backup that targets sensitive system files, such as the Active Directory database (ntds.dit) or registry hives (SYSTEM, SECURITY). This behavior is characteristic of an attempt to stage sensitive credentials or system configuration data for offline analysis or exfiltration, often performed as part of a credential dumping effort.
Detects the use of the Windows Backup utility (wbadmin.exe) to initiate a backup of the Active Directory database (NTDS.dit) and registry hives to a local SMB loopback share. This behavior is a technique used by Akira ransomware actors to bypass file locking mechanisms and exfiltrate sensitive credential material.
This rule detects repeated access attempts (3 or more within an hour) to critical credential storage processes or files, specifically lsass.exe, the Security Account Manager (SAM) database, or the NTDS.dit file. Such activity is indicative of credential theft attempts by an adversary.
Detects potential credential dumping activities and unauthorized access to sensitive system files. The rule monitors for three primary indicators: raw disk device access (often associated with volume shadow copy dumping), suspicious DiskShadow utility execution, and NTDS.dit extraction using ntdsutil. Known administrative and backup software processes are excluded to minimize noise.
Detects instances where the Active Directory domain database file (ntds.dit) is accessed by processes other than known legitimate tools such as lsass.exe or ntdsutil.exe. This activity is a strong indicator of credential dumping attempts to extract Active Directory hashes.
Detects the creation of a file named 'NTDS.zip', which is a common naming convention used by adversaries when compressing the Active Directory database (NTDS.dit) for staging and subsequent exfiltration.
Detects Zerologon exploitation attempts against domain controllers by monitoring for anomalous machine account password resets, execution of known exploitation tooling (e.g., zerologon_tester, secretsdump), and patterns of rapid Netlogon zero-credential authentication failures.
This rule monitors for the execution of native Windows utilities (vssadmin.exe, ntdsutil.exe, diskshadow.exe, esentutl.exe) commonly abused by attackers to create volume shadow copies or access the NTDS.dit file for credential dumping or system recovery inhibition.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
This rule detects when critical Windows services or processes associated with Active Directory (NTDS, Netlogon, LSASS, LDAP) or the Print Spooler (Spooler, spoolsv.exe) crash multiple times (3 or more) on a machine within a 7-day period. This could indicate instability, a denial-of-service attempt, or a system compromise affecting core services.
Detects the unauthorized use of 'wbadmin.exe' to initiate a backup of Active Directory components (like 'ntds.dit' or the SYSTEM registry hive) when executed from common command-line interpreters (cmd.exe, powershell.exe). The rule correlates this backup activity with subsequent direct file access to sensitive AD database or registry files by processes other than standard system services (e.g., ntds.exe, lsass.exe), often indicative of credential dumping or exfiltration.
Detects a suspicious sequence of adversary behaviors typically associated with pre-ransomware activity. The rule identifies high-volume SMB scanning (more than 20 unique IPs in 5 minutes) correlated with network share discovery (using tools like netscan.exe or PowerShell scripts such as Invoke-ShareFinder), and optionally links these actions to credential dumping events on the same host (LSASS dumping via comsvcs.dll or NTDS.dit exfiltration via wbadmin) within a 48-hour window.
Detects the execution of known Impacket framework scripts such as psexec.py, wmiexec.py, and secretsdump.py, or command lines containing common indicators associated with these tools. The rule monitors process start events and filters for indicators of lateral movement and credential harvesting including administrative share access and lsass or ntds.dit interaction.
Detects the use of the built-in Windows tool 'ntdsutil.exe' to perform an Install from Media (IFM) operation, which creates a copy of the Active Directory database (NTDS.dit). The rule specifically flags when this output is directed to suspicious paths like 'C:\Windows\Temp' or 'C:\Users\Public', which are common locations used by adversaries to stage files for exfiltration.
Detects the use of the built-in Windows tool 'ntdsutil.exe' to perform an Install from Media (IFM) operation, which creates a copy of the Active Directory database (NTDS.dit). The rule specifically flags when this output is directed to suspicious paths like 'C:\Windows\Temp' or 'C:\Users\Public', which are common locations used by adversaries to stage files for exfiltration.
This rule detects unauthorized access attempts to Active Directory Directory Replication Services using Event ID 4662. It specifically monitors for the access mask 0x100 (Control Access) against the Domain Replication Service GUIDs, which are often indicative of techniques like DCSync used to harvest credentials or replicate the NTDS.dit database.
Page 5 of 14