Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects the presence of keywords like "lsass" and ".dmp" in the command line, which indicates a potential attempt to dump the LSASS process memory. This technique is commonly used by adversaries to extract credentials.
This rule detects the creation of shadow copies using operating system utilities such as PowerShell, WMIC, or VSSAdmin. Adversaries often create shadow copies to access credential material, specifically the NTDS.dit file or SAM database, for offline analysis. The rule looks for specific executable names combined with command-line arguments containing 'shadow' and 'create'.
Detects suspicious access to Domain Group Policies stored in the SYSVOL share. This rule specifically looks for command-line activity that includes both '\SYSVOL\' and '\policies\', indicating an attempt to interact with Group Policy objects.
Detects the use of esentutl.exe to interact with Volume Shadow Copy Service (VSS) registry keys. This activity can be indicative of attempts to access or dump credentials, particularly from the Security Account Manager (SAM) database, which is often stored in the registry and can be targeted via VSS snapshots.
This rule detects attempts to dump credentials from the Windows Credential Manager using PowerShell. It specifically looks for the use of known PowerShell functions or code patterns associated with credential dumping tools or techniques. This includes functions like 'Get-PasswordVaultCredentials' and 'Get-CredManCreds', as well as the instantiation of .NET objects related to 'Windows.Security.Credentials.PasswordVault' or specific CSharpCodeProvider patterns often used in reflective loading or dynamic compilation for credential access.
This rule detects attempts to enumerate credentials from the Windows Credential Manager using PowerShell. It specifically looks for PowerShell script block text containing both 'vaultcmd' and '/listcreds:', combined with keywords like 'Windows Credentials' or 'Web Credentials'. This activity is indicative of an adversary trying to obtain stored user credentials.
This rule detects PowerShell script block text that contains commands indicative of searching for credentials in files. Specifically, it looks for the combination of 'ls' (list directory contents), '-R' (recursive search), 'select-string' (finds text in strings and files), and '-Pattern' (specifies the text pattern to find). This combination suggests an adversary is recursively searching files for specific patterns, likely credentials.
This rule detects the creation of a symbolic link (symlink) to a Volume Shadow Copy using the 'mklink' command-line utility. Adversaries often create symlinks to shadow copies to access and exfiltrate sensitive data, such as credential hashes from the Security Account Manager (SAM) database or the Active Directory database (NTDS.dit), without directly interacting with the live system files. This technique is commonly used as part of credential dumping activities.
Detects the execution of tools from SecurityXploded, specifically focusing on 'PasswordDump.exe'. These tools are often used for credential dumping, which involves extracting credentials from various password stores on a system.
Detects the execution of WebBrowserPassView.exe, a password recovery tool that reveals passwords stored by various web browsers including Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera. This tool is often used by adversaries to extract credentials from compromised systems.
This rule detects attempts to enumerate credentials stored in the Windows Registry using the `reg.exe` utility. Specifically, it looks for `reg.exe` commands that query for string values (`/t REG_SZ`) recursively (`/s`) within the HKLM (Local Machine) or HKCU (Current User) hives, or specifically targets the PuTTY sessions key in HKCU. This activity is indicative of an adversary searching for insecurely stored credentials that can be used for further access.
Detects a command that accesses the Volume Shadow Copy to extract sensitive files such as the Security or SAM registry hives or the Active Directory database (ntds.dit). This activity is often associated with credential dumping.
Detects when a non-Sysinternals tool attempts to set the 'EulaAccepted' registry key for a Sysinternals tool. This behavior is indicative of an adversary attempting to use renamed Sysinternals tools to evade detection, as the 'EulaAccepted' key is typically set by the legitimate Sysinternals tool upon its first execution.
This rule detects the use of 'PromptForCredential' within PowerShell script block logs. This function is used to display a dialog box that prompts the user for credentials, which can be abused by adversaries to harvest user credentials. Detection relies on PowerShell Script Block Logging being enabled.
This rule detects the execution of a PowerShell command containing 'Get-Process lsass' within a script block. This command is commonly used by attackers to identify the LSASS process ID before attempting to dump its memory for credential harvesting. The detection relies on PowerShell Script Block Logging being enabled.
Detects suspicious access to the Local Security Authority Subsystem Service (LSASS) process memory. This rule specifically looks for access to 'lsass.exe' originating from 'svchost.exe' with a specific suspicious access right ('0x14c0') and a call trace indicating 'seclogon.dll'. This combination suggests an attempt to dump LSASS memory, potentially to steal credentials.
Detects a possible process memory dump of LSASS using processes with whitelisted filenames (like TrolleyExpress.exe, ProcessDump.exe, dump64.exe) to evade detection by security products like Microsoft Defender. The rule specifically looks for access to lsass.exe with granted access rights commonly associated with memory dumping.
Detects command-line arguments that are characteristic of Cobalt Strike modules or commands, which may indicate an operator error where these commands are accidentally typed into a command prompt instead of the Cobalt Strike console. This rule specifically looks for common 'Invoke-' PowerShell module names and other Cobalt Strike related keywords executed via 'cmd.exe'.
Detects the usage of 'pypykatz' to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored. The rule specifically looks for the execution of 'pypykatz.exe' or 'python.exe' with command-line arguments indicating 'live' and 'registry' access, which are common parameters for dumping credentials from the live registry hive.
Detects the execution of the hacktool SafetyKatz, which is used for credential dumping, by identifying its executable name, original file name, or description in process creation events.
This rule detects the creation of a new process where both the parent process and the new process are 'lsass.exe'. This behavior is highly suspicious and indicative of credential dumping techniques, specifically attempts to clone the LSASS process to extract credentials without directly interacting with the original LSASS process, which might be protected by security solutions.
Page 221 of 229