Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
42 detections
Filters
Last updated
All Time
Detection languages
29
9
2
1
1
Contributors
14
13
6
2
2
Categories
17
13
13
11
4
Platforms
42
1
Products / Services
14
11
6
3
3
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
IDS Classtypes
1
IDS Protocols
1
Detects usage of "cmdkey.exe" to add generic credentials.
As an example, this can be used before connecting to an RDP session via command line interface.
As an example, this can be used before connecting to an RDP session via command line interface.
Detection well-known mimikatz command line arguments
Detects well-known credential dumping tools execution via service execution events
' This hunting query looks for process command line activity related to activity observed by Dev-0056.The command lines this query hunts for are used as part of the threat actor's post exploitation activity.
This query uses the Microsoft Sentinel Information Model - https://docs.microsoft.com/azure/sentinel/normalization'
This query uses the Microsoft Sentinel Information Model - https://docs.microsoft.com/azure/sentinel/normalization'
Detection well-known mimikatz command line arguments
Detects usage of cmdkey to look for cached credentials on the system
Detects usage of "cmdkey.exe" to add generic credentials.
As an example, this can be used before connecting to an RDP session via command line interface.
As an example, this can be used before connecting to an RDP session via command line interface.
Detects well-known credential dumping tools execution via specific named pipe creation
Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
The analytic identifies a process command line querying the CachedLogonsCount registry value in the Winlogon registry. This activity can indicate the use of post-exploitation tools like Winpeas, which gather information about login caching settings. If confirmed malicious, this activity could help attackers understand login caching configurations, potentially aiding in credential theft or lateral movement within the network.
This rule detects the execution of well-known credential dumping tools by monitoring Windows System event logs for Service Control Manager events (EventID 7045) indicating service creation. The rule specifically looks for service image paths containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This helps identify attempts to install and run these tools as services for credential theft.
This rule detects the execution of Mimikatz by identifying specific command-line arguments and keywords commonly associated with its various modules and functions. It looks for terms like 'DumpCreds', 'mimikatz', and module-specific keywords such as '::aadcookie', '::detours', 'sekurlsa::', 'kerberos::', and 'lsadump::'. The rule aims to identify attempts to dump credentials or perform other malicious actions using the Mimikatz tool.
This rule detects the creation of files with names commonly associated with credential dumping tools or the output files generated by such tools. This includes executables of known credential dumpers like fgdump, pwdump, cachedump, procdump, and Windows Credential Editor (WCE), as well as output files like 'fgdump-log', 'kirbi', 'pwdump', 'pwhashes', 'wce_ccache', 'wce_krbtkts', 'NTDS.out', 'SAM.out', 'SECURITY.out', and 'SYSTEM.out'.
Detects the creation of named pipes commonly used by credential dumping tools such as Mimikatz (wceservicepipe) and other tools that might use 'cachedump' or 'lsadump' in their pipe names to extract credentials.
Detects the usage of 'reg.exe' to dump sensitive registry hives, specifically targeting the SAM, SYSTEM, and SECURITY hives. This activity is indicative of credential dumping attempts.
Detects well-known credential dumping tools execution via specific named pipe creation
Detects well-known credential dumping tools execution via service execution events
Detects well-known credential dumping tools execution via service execution events
Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
Detection well-known mimikatz command line arguments
Page 2 of 2