Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects the creation of memory dump files (.dmp, .hdmp) by common scripting or shell applications such as cmd.exe, powershell.exe, cscript.exe, mshta.exe, pwsh.exe, or wscript.exe. Memory dumps can contain sensitive information like credentials, and their creation by these processes can be indicative of malicious activity, especially if not tied to a legitimate crash.
This rule detects the creation of a dump file by the password dumper tool QuarksPwDump. Specifically, it looks for files created in the 'AppData\Local\Temp\' directory with names starting with 'SAM-' and ending with '.dmp'. This pattern indicates that QuarksPwDump is attempting to dump the Security Account Manager (SAM) database, which contains local user credentials.
Detects suspicious process patterns indicative of CrackMapExec (CME) being used to dump LSASS credentials. The rule looks for specific command-line arguments used by CME for LSASS dumping, including combinations of 'tasklist' with 'Imagename eq lsass.exe', 'rundll32.exe' with 'comsvcs.dll' and temporary paths, and 'tasklist' with 'findstr /i "lsass"'. These patterns are commonly observed when attackers attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory.
Detects the usage of 'reg.exe' to dump sensitive registry hives, specifically targeting the SAM, SYSTEM, and SECURITY hives. This activity is indicative of credential dumping attempts.
This rule detects the execution of 'rundll32.exe' with specific command-line arguments ('keymgr' and 'KRShowKeyMgr') which indicates an attempt to invoke the Stored User Names and Passwords dialogue, also known as the Key Manager. This activity can be used by adversaries to access or backup stored credentials.
Detects the execution of various scripting interpreters or command-line tools via a LNK file accessed from a WebDAV share. This technique is often used by adversaries to bypass security controls and execute malicious code, leveraging the `DavWWWRoot` path to indicate WebDAV access. The parent process is expected to be `explorer.exe`, suggesting user interaction.
Detects changes to the Windows Registry that configure a monitor program to dump the memory of the lsass.exe process using the SilentProcessExit technique. This method leverages Image File Execution Options (IFEO) to trigger a memory dump of LSASS when it exits, which can be used to extract credentials.
This rule detects the creation of a file named 'lsass.exe.dmp' within the 'C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\' directory. This specific file pattern and location are indicative of an attempt to dump the LSASS process memory, which often contains sensitive credential material. Adversaries frequently use this technique to extract credentials for lateral movement or persistence. The rule specifically references the 'LSASS Shtinkering' technique, which abuses Windows Error Reporting to achieve LSASS memory dumping.
Detects `rundll32.exe` loading a renamed `comsvcs.dll` to dump process memory, which is a common technique for credential dumping, specifically targeting LSASS. The rule looks for `rundll32.exe` executions where the loaded image is NOT the legitimate `comsvcs.dll` (implying a renamed or malicious version).
Detects PowerShell script blocks that contain commands used to export certificates from the local certificate store. This activity can be abused by threat actors to steal private keys from compromised machines.
This rule detects suspicious PowerShell script blocks that contain specific .NET classes often used in LDAP-based credential access attempts. The presence of 'System.DirectoryServices.Protocols.LdapDirectoryIdentifier', 'System.Net.NetworkCredential', and 'System.DirectoryServices.Protocols.LdapConnection' within a PowerShell script block suggests an attempt to interact with an LDAP directory, potentially for password guessing or brute-force attacks against accounts.
Detects attempts to dump LSASS process memory using WerFault.exe. This technique is often used by tools like Mimikatz, NanoDump, Invoke-Mimikatz, Procdump, or Taskmgr to extract credentials from the Local Security Authority Subsystem Service (LSASS) process. The rule specifically looks for WerFault.exe accessing lsass.exe with a GrantedAccess of '0x1FFFFF', which indicates full access.
Detects a possible process memory dump of lsass.exe using a renamed or masqueraded executable named 'TrolleyExpress.exe'. This technique leverages the whitelisted nature of the legitimate Citrix TrolleyExpress.exe to evade detection while attempting to dump LSASS memory, often indicated by command-line arguments targeting process IDs in the 700-999 range or the '-ma' flag for memory dumping.
Detects the use of Cobalt Strike commands entered into the command shell. This rule specifically looks for common Cobalt Strike post-exploitation commands such as 'psinject', 'spawnas', 'make_token', 'remote-exec', 'rev2self', 'dcsync', 'logonpasswords', 'execute-assembly', and 'getsystem' when executed via cmd.exe. This often indicates an operator error where Cobalt Strike commands are mistakenly typed directly into a compromised system's command prompt instead of the Cobalt Strike beacon console.
This rule detects the execution of the password guessing hack tool Hydra based on specific command-line parameters. It looks for the presence of '-u ' and '-p ' which are commonly used to specify username and password lists, respectively. Additionally, it checks for the keywords '^USER^' and '^PASS^' which are often used as placeholders in Hydra's command-line arguments for iterating through user and password lists during a brute-force attack.
Detects the use of 'aspnet_regiis.exe' with specific command-line arguments to decrypt Microsoft IIS connection strings. This activity is indicative of an attacker, potentially with web shell access, attempting to extract sensitive credentials like MSSQL service account passwords from IIS configurations.
Detects the execution of 'netsh.exe' with the 'trace' and 'start' flags, indicating that a network trace capture has been initiated. This activity can be used by adversaries for network sniffing to gather information about the environment, including credentials or network configurations.
Detects the execution of 'ntdsutil.exe' with command-line arguments indicating snapshot operations, specifically mounting a snapshot. This activity can be suspicious as 'ntdsutil.exe' is a legitimate Active Directory diagnostic tool that can be abused by adversaries to extract the NTDS.dit file, which contains sensitive credential information.
Detects calls to PowerShell cmdlets used to export certificates from the local certificate store. Threat actors have been observed abusing this technique to steal private keys from compromised machines, which can then be used for authentication or decryption.
This rule detects attempts to coerce NTLM authentication on the Printer Spooler service, which can be used for privilege escalation. Specifically, it looks for `rundll32.exe` executing with command-line arguments related to `davclnt.dll,DavSetCookie` and keywords like `spoolss`, `srvsvc`, or `/print/pipe/`, indicating an NTLM relay attack against the print spooler service.
This rule detects the execution of command-line tools like 'dir' or 'findstr' in conjunction with specific file extensions (e.g., .doc, .pdf, .txt) that are commonly associated with sensitive data or credentials. This behavior indicates an attempt at automated collection of data, potentially for exfiltration or further analysis by an adversary. The rule specifically looks for 'dir' commands with '/b' (bare format) and '/s' (subdirectories) flags, or 'findstr' with '/e' (end of line) and '/si' (case-insensitive search for string in files) flags, targeting common document and text file types.
Page 220 of 229