Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects the installation of the Azure Hybrid Connection Manager service by monitoring registry modifications. This service can be used to allow remote code execution from Azure functions, potentially as a method for adversaries to establish persistence or facilitate further access.
Detects Microsoft Outlook attempting to initiate a connection to a WebDAV or SMB share by querying specific registry keys. This behavior is indicative of an exploitation attempt related to CVE-2023-23397, where an attacker could force Outlook to connect to a malicious share and leak NTLM hashes.
Detects the loading of `dbghelp.dll` or `dbgcore.dll` by processes that are typically not expected to load these DLLs. These DLLs export functions like `MiniDumpWriteDump` which can be used to dump process memory, including sensitive information like credentials from processes such as LSASS. This behavior is often observed in attacker tradecraft, such as with the SilentTrinity C2 Framework, or by legitimate debugging tools like ProcessHacker. The rule includes filters for common legitimate Windows processes and services that might load these DLLs to reduce false positives. Investigation of the command line and image location of the process loading the DLL is recommended.
Detects a PowerShell process attempting to access the Local Security Authority Subsystem Service (LSASS) process memory. This activity is a strong indicator of potential credential dumping attempts, where an attacker tries to extract sensitive authentication material (like passwords or hashes) from memory.
This rule identifies when Kubernetes secrets are modified or deleted within a Google Cloud Platform (GCP) environment. It specifically looks for audit log entries related to the creation, update, patch, or deletion of Kubernetes secrets.
This rule detects commands commonly used on Cisco network devices to collect configuration data, which may contain sensitive information such as credentials. The commands include 'show running-config' to display the current operational configuration, 'show startup-config' to display the configuration loaded at boot, and 'show archive config' which can show archived configurations. An adversary might use these commands to gather information about the network, discover credentials, or understand the device's security posture.
Detects Label Distribution Protocol (LDP) authentication failures on Cisco devices, which could indicate an adversary attempting to brute force LDP authentication to manipulate MPLS labels. This could be part of an effort to disrupt network traffic or gain unauthorized access.
Detects Windows error reporting events where the Local Security Authority Subsystem Service (LSASS) process crashes with a specific exception code. This behavior can indicate an intentional crash, often associated with techniques like Lsass-Shtinkering, to facilitate credential dumping from LSASS memory.
Detects password dumper activity by monitoring remote thread creation (EventID 8) where the target process is 'lsass.exe'. The process initiating the remote thread is the malicious program. A single execution of such a tool can generate numerous events.
This rule detects the execution of the `Get-ADReplAccount` cmdlet from the DSInternals PowerShell module with specific parameters (`-All` and `-Server`). This cmdlet is used to perform a DCSync attack, which allows an attacker to retrieve password hashes and other sensitive Active Directory information by simulating a domain controller replication. The DSInternals module provides advanced capabilities for Active Directory manipulation and auditing, and its use in this manner is highly suspicious and indicative of credential access attempts.
Detects the use of the 'reg.exe' utility to disable Protected Process Light (PPL) protection for the Local Security Authority (LSA) process. This modification can allow attackers to dump LSA secrets, which contain credential material.
Detects a command line pattern used by the Conti ransomware group to archive and stage the NTDS.dit database for exfiltration. The rule specifically looks for the execution of '7za.exe' (7-Zip archiver) with a command line that includes '\C$\temp\log.zip', indicating the creation of a zip archive in a temporary location, a common step before exfiltration.
Detects command line usage of "findstr.exe" to search for keywords related to "passwords" in various languages. This activity can indicate an adversary attempting to locate credentials stored in files on a compromised system.
This rule identifies activities related to Google Cloud Platform (GCP) Packet Mirroring. Packet Mirroring allows capturing full network traffic, which can be abused by adversaries to intercept and collect sensitive data from unencrypted internal network communications. The rule specifically looks for various API calls related to the creation, modification, deletion, or listing of Packet Mirroring configurations.
This rule detects when a monitor, SPAN (Switched Port Analyzer), or RSPAN (Remote Switched Port Analyzer) is configured or modified on a Cisco network device. These configurations are often used for network sniffing or traffic analysis, which can be legitimate for troubleshooting but also abused by adversaries for data exfiltration or reconnaissance.
This rule detects the execution of 'show history', 'show history all', or 'show logging' commands on Cisco devices. These commands can expose sensitive information, including credentials, that have been entered into the device's command-line interface. Adversaries may use these commands to gather credentials or other sensitive configuration details from network devices.
Detect standard users login that are part of high privileged groups such as the Administrator group
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory from non-system accounts, which is a common technique used by credential dumping tools like Mimikatz. The rule specifically looks for security events (4663 or 4656) related to process object access with specific access masks targeting 'lsass.exe', while filtering out legitimate system accounts and known benign processes.
Detects the creation of an 'ntds.dit' file, which contains Active Directory database information including credential hashes, by processes commonly abused by attackers or processes running from suspicious directories like 'Temp' or 'AppData'. This activity is highly indicative of credential dumping attempts.
Detects the creation of the 'ntds.dit' file, which contains Active Directory database information, by processes that are not typically associated with this activity. This rule specifically looks for 'ntds.dit' creation when the parent process is an uncommon executable (e.g., cscript.exe, powershell.exe, web server processes) or originates from suspicious directories (e.g., AppData, Temp, Public). This activity often indicates an attempt to dump Active Directory credentials.
Page 217 of 229