Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
This rule detects suspicious PowerShell scripts attempting to copy the Security Account Manager (SAM) database. It specifically looks for PowerShell command lines that include both a reference to a volume shadow copy (e.g., '\HarddiskVolumeShadowCopy') and the SAM file path ('System32\config\sam'), combined with common PowerShell copy commands or .NET file copy methods. This activity is indicative of an adversary trying to extract credentials by accessing the SAM database, often from a shadow copy to bypass file locks.
Detects the execution of 'ditsnap.exe', a tool used to inspect the Active Directory database (ntds.dit). This tool can be used by adversaries to dump credentials from a domain controller.
This rule detects suspicious modifications to the Windows Registry related to the 'ms-settings' URI scheme, specifically targeting the 'DelegateExecute' value or the default value of 'HKCU\Software\Classes\ms-settings\Shell\Open\Command'. This technique can be used by adversaries to hijack the execution of applications launched via the 'ms-settings' URI, potentially leading to arbitrary code execution or privilege escalation. The rule also includes a detection for the deletion of the 'ms-settings' key, which could be an attempt to clean up after such an attack.
Detects suspicious invocation of the Get-ADDBAccount PowerShell script that reads from an ntds.dit file. This technique can be used to gain access to credentials without relying on traditional credential dumping tools. The rule specifically looks for the presence of 'Get-ADDBAccount', 'BootKey', and 'DatabasePath' in the PowerShell payload, indicating an attempt to extract credentials from an NTDS database file.
This rule detects the use of the built-in Windows 'copy' command via 'cmd.exe' to transfer files with '.dmp', '.dump', or '.hdmp' extensions from a remote network share (indicated by '\\') to a local system. This activity is often associated with credential dumping techniques where memory dumps (e.g., LSASS process memory dumps) containing sensitive information are exfiltrated or staged.
Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content from it. This technique has been observed in malicious LNK files, often used for initial access or execution of payloads from remote shares.
Detects the execution of the built-in 'copy' command targeting a Volume Shadow Copy. This technique is often used by adversaries to exfiltrate sensitive files, such as registry hives, that are actively in use and locked by the operating system. By copying from a shadow copy, adversaries can bypass file locks and access system-critical data.
This rule detects attempts to bypass Windows Defender by renaming a legitimate tool, specifically `procdump`, to `dump64.exe` and placing it within a Microsoft Visual Studio installation directory. This technique is often used to dump LSASS memory for credential access.
This rule detects common flag combinations used by CrackMapExec, a post-exploitation tool, to identify its execution even if the binary name has been changed. It looks for specific command-line arguments related to local authentication, hash-based authentication, and module usage for SMB and MSSQL protocols.
Detects the execution of Inveigh, a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool, by looking for its executable name, original file name, description, or specific command-line arguments indicative of its spoofing/sniffing functionality.
This rule detects the use of PowerShell's `Get-Process` cmdlet or its aliases (`ps`, `gps`) specifically targeting the `lsass` process. Accessing the `lsass` process memory is a common technique used by attackers to dump credentials, making this activity highly suspicious and indicative of potential credential theft.
This rule detects the execution of LiveKD, a Sysinternals tool, based on its executable name or original filename metadata. LiveKD allows users to examine a live system's kernel memory, which can be abused by attackers for memory dumping activities, particularly for credential extraction.
This rule detects attempts to list credentials stored in the Windows Credential Manager using the native Windows utility `vaultcmd.exe`. Specifically, it looks for process creation events where `VaultCmd.exe` is executed with the `/listcreds:` command-line argument, indicating an attempt to enumerate stored credentials.
Detects when an internet-hosted WebDAV share is mounted using the `net.exe` or `net1.exe` utility. This activity can be indicative of an adversary attempting to establish remote access or exfiltrate data by mounting a remote share.
This rule detects attempts to discover private key files using command-line tools such as `cmd.exe`, `powershell.exe`, or `findstr.exe`. It specifically looks for commands that include common private key file extensions like .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, and .asc. This activity is indicative of an adversary searching for insecurely stored credentials on a compromised system.
Indicates that a password spray attack has been successfully performed.
Detects Access to Domain Group Policies stored in SYSVOL
Detects command line parameters used by Hydra password guessing hack tool
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns
Detects when the file "passwd" or "shadow" is copied from tmp path
Page 222 of 229