Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects when an Office application loads the 'kerberos.dll' library. This behavior is unusual for standard Office operations and could indicate an attempt to manipulate Kerberos authentication, potentially for credential access or privilege escalation.
Detects the creation of named pipes commonly used by credential dumping tools such as Mimikatz (wceservicepipe) and other tools that might use 'cachedump' or 'lsadump' in their pipe names to extract credentials.
Detects access to the LSASS process by a Python-based tool, indicated by specific call trace patterns involving Python DLLs and KERNELBASE.dll/ntdll.dll, combined with a broad granted access right (0x1FFFFF). This activity is characteristic of credential dumping tools like LaZagne or Pypykatz.
Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments indicating the use of 'davclnt.dll,DavSetCookie' and a remote IP address. This activity is suspicious as it can be an indicator of data exfiltration, execution of code hosted on a WebDAV server, or exploitation related to CVE-2023-23397, particularly for NTLM hash theft.
Detects the execution of 'setspn.exe' with the query flag ('-q' or '/q'), which is commonly used by attackers to enumerate Service Principal Names (SPNs) as a precursor to Kerberoasting attacks. This activity can help identify potential attempts to discover service accounts with weak passwords that can be cracked offline.
Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
This rule detects when an application is granted delegated or app role permissions within Microsoft Graph, Exchange, SharePoint, or Azure AD. This activity can indicate an adversary attempting to establish persistence or elevate privileges by giving a malicious application access to sensitive resources.
This rule detects an anomaly in Apache Guacamole sessions where two users are simultaneously present in the same session. This could indicate unauthorized access, session hijacking, or a shared credential scenario that deviates from normal behavior.
This rule detects attempts to dump the NTDS.dit database to suspicious locations. It specifically looks for ESENT event ID 325 (New Database Created) where the data contains 'ntds.dit' and the path includes common suspicious directories such as Appdata, Desktop, Downloads, Perflogs, Temp, or Users\Public.
This rule detects a potential Kerberos Replay Attack on domain controllers. It specifically looks for Event ID 4649, which indicates that a "KRB_AP_ERR_REPEAT" Kerberos response was sent to the client. This error signifies that the KDC detected a replay of a Kerberos Application Server (AP) request, suggesting an adversary might be attempting to reuse stolen Kerberos tickets to gain unauthorized access.
Detects attempts to request a handle to the Security Account Manager (SAM) registry hive. Accessing the SAM hive can indicate an adversary attempting to dump credentials.
This rule detects the mounting of a volume shadow copy, specifically looking for Event ID 98 from the Microsoft-Windows-Ntfs provider where the DeviceName contains 'HarddiskVolumeShadowCopy'. Adversaries may mount volume shadow copies to access files, including credential stores like the Security Account Manager (SAM) database, without directly interacting with the live file system, which can bypass some security controls.
Detects the creation of specific files commonly associated with Mimikatz, a credential dumping tool. Specifically, it looks for files ending with '.kirbi' (Kerberos tickets) or named 'mimilsa.log' (related to MemSSP). This activity often indicates an attempt to steal Kerberos credentials or other sensitive authentication information.
Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
Detects WerFault creating a dump file with a name that indicates the dump file could be an LSASS process memory dump, which contains user credentials. This technique is often used by adversaries to extract credentials for lateral movement or privilege escalation.
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. This rule detects PowerShell commands attempting to copy browser login data files from common web browsers like Opera, Firefox, Microsoft Edge, and Google Chrome.
Detects PowerShell execution that enumerates Active Directory users with the 'DONT_REQ_PREAUTH' flag set (UserAccountControl flag 4194304). This flag indicates that the account does not require Kerberos pre-authentication, making it vulnerable to AS-REP Roasting attacks where an attacker can request a Ticket Granting Ticket (TGT) without providing credentials and then attempt to crack the hash offline.
This rule detects the use of `find.exe` or `findstr.exe` to search for the string 'cpassword' within XML files located in the SYSVOL share. This activity is indicative of an adversary attempting to locate encrypted Group Policy Preferences (GPP) passwords, which can then be decrypted to obtain credentials.
This rule detects the execution of the Hashcat password cracking tool. It specifically looks for the `hashcat.exe` executable and command-line arguments indicative of cracking NTLM hashes (`-m 1000`) and using a rule file (`-r `). The rule aims to identify attempts to crack passwords, potentially using SAM file contents obtained from a Windows registry.
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
This rule detects attempts by PowerShell processes (powershell.exe or pwsh.exe) to create a remote thread in the Local Security Authority Subsystem Service (LSASS) process. This activity is a common technique used by adversaries to dump credentials from memory.
Page 218 of 229