Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects the execution of Quarks PwDump, a tool used for dumping credentials, by monitoring process creation events for its executable name and specific command-line arguments. The rule looks for 'QuarksPwDump.exe' and various flags associated with dumping local hashes, domain cached hashes, BitLocker keys, and domain hashes, including those from NTDS files.
Detects the usage of the Time Travel Debugging (TTD) utility (tttracer.exe). Adversaries can leverage tttracer.exe to execute malicious processes or dump process memory, such as LSASS, for credential access. This rule specifically looks for process creation events where tttracer.exe is the parent process, indicating its use to launch other processes.
Detects the execution of 'ntdsutil.exe', a Windows command-line tool that can be used to perform various operations on the Active Directory database (NTDS.DIT). Adversaries may use this tool to extract credential information or other sensitive data from the NTDS.DIT file.
Detects potential credential dumping via the Windows Error Reporting (WER) LSASS Shtinkering technique. This technique abuses WerFault.exe to dump the LSASS process memory. The rule specifically looks for WerFault.exe being executed with command-line arguments indicating a dump of a target process (-p) that is not the source process (-ip), and where the target process is likely LSASS.
Detects the setting of the "DumpType" registry value to "2" (Full Dump) within the Windows Error Reporting LocalDumps configuration. This specific setting is required by techniques like LSASS Shtinkering to facilitate dumping of the LSASS process memory, which often contains sensitive credential material.
Detects when a new owner is added to an application in Azure AD. This action grants the newly added account privileges to modify and configure the application, which could be abused by an attacker to maintain persistence, elevate privileges, or access sensitive data.
Detects the registration of the VSSAudit security event source, which typically occurs during volume shadow copy operations. This can be indicative of credential dumping attempts, specifically targeting the Security Account Manager (SAM) database.
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name (SAM or SECURITY) located in the temporary directory have been reset. This behavior can occur when an application attempts to access a hive that has not been recognized for a period (default 7 days). Registry hive dumping utilities such as QuarksPwDump have been observed to exhibit this behavior, which is often associated with credential dumping.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory, which is a common technique used by attackers to steal credentials. The detection is specifically triggered by Windows Defender's Attack Surface Reduction (ASR) rule for blocking credential stealing from LSASS, indicated by EventID 1121 and the target path ending with '\lsass.exe'. The rule includes filters to reduce false positives from legitimate processes that might interact with LSASS.
This rule detects the creation of files with specific naming conventions that are indicative of tools exploiting the HiveNightmare (CVE-2021-36934) vulnerability to export the Security Account Manager (SAM) database. The rule looks for various file names and patterns used by different implementations of HiveNightmare exploitation tools, including those written in Go, C++, PowerShell, and C#.
Detects the creation of a file named 'debug.bin' in the '\Temp\' directory, which is the default output filename used by the SafetyKatz tool for dumping LSASS memory. This activity is indicative of an attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process.
This rule detects when 'credui.dll' or 'wincredui.dll' is loaded by a process that is not commonly associated with these DLLs. Attackers might load these DLLs to interact with Windows Credential Provider functions like 'CredUIPromptForCredentials' or 'CredUnPackAuthenticationBufferW' to prompt users for credentials or extract them.
This rule detects when an unsigned image (DLL or EXE) is loaded into the Local Security Authority Subsystem Service (LSASS) process. Adversaries often inject malicious, unsigned code into LSASS to dump credentials, as LSASS stores sensitive authentication material. Detecting unsigned code in this critical process can indicate an attempt at credential dumping or other forms of privilege escalation.
Detects attempts to access the LSASS process memory by tools or processes that have the keyword "dump" in their image name. This behavior is indicative of credential dumping activities, where adversaries try to extract sensitive information like passwords and hashes from the LSASS process.
This rule detects the use of the legitimate Microsoft SQL Server utility `sqldumper.exe` to dump process memory. Specifically, it looks for `sqldumper.exe` being executed with command-line arguments that indicate an attempt to dump a process, such as '0x0110' or '0x01100:40'. This technique can be abused by attackers to dump sensitive processes like LSASS (Local Security Authority Subsystem Service) to extract credentials.
Detects the usage of the 'sqlite' or 'sqlite3' binaries to query specific database files associated with Firefox and other Gecko-based browsers, such as 'cookies.sqlite' and 'places.sqlite'. This activity is indicative of potential data stealing, particularly targeting browser history, bookmarks, and session cookies.
Detects when highly privileged delegated permissions are granted on behalf of all users in Azure Active Directory. This can indicate an attempt to gain broad access to resources by an application.
Detects the loading of unsigned dbghelp.dll or dbgcore.dll, which are DLLs used for creating memory dumps. This activity is suspicious as these DLLs are often leveraged by attackers, for example, to dump credentials from processes like LSASS using the MiniDumpWriteDump API. Tools like ProcessHacker and the SilentTrinity C2 Framework are known to use this technique.
Detects the loading of DLLs associated with the Time Travel Debugging (TTD) utility. Adversaries can leverage TTD, specifically `tttracer.exe`, to execute malicious processes or dump sensitive process memory, such as that of `lsass.exe`, for credential access. This rule focuses on the dynamic loading of TTD-related DLLs, indicating potential use of the utility.
Detects the execution of PowerShell scripts containing patterns commonly associated with Mimikatz, a tool used for dumping credentials. The rule looks for specific strings related to Mimikatz functionalities like 'DumpCreds', 'DumpCerts', 'sekurlsa::logonpasswords', and 'crypto::certificates' in conjunction with 'CERT_SYSTEM_STORE_LOCAL_MACHINE'.
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass. This technique is often used to extract credentials.
Page 219 of 229