attack.credential_access | Detection.FYI

Cisco BGP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Read More
Cisco LDP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Read More
Copy Passwd Or Shadow From TMP Path

Dec 1, 2023 · attack.credential_access attack.t1552.001 ·
Share on:

Detects when the file "passwd" or "shadow" is copied from tmp path

Read More
Github High Risk Configuration Disabled

Dec 1, 2023 · attack.credential_access attack.defense_evasion attack.persistence attack.t1556 ·
Share on:

Detects when a user disables a critical security feature for an organization.

Read More
HackTool - HandleKatz LSASS Dumper Execution

Dec 1, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

Read More
HackTool - Inveigh Execution

Dec 1, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

Read More
HackTool - KrbRelay Execution

Dec 1, 2023 · attack.credential_access attack.t1558.003 ·
Share on:

Detects the use of KrbRelay, a Kerberos relaying tool

Read More
HackTool - KrbRelayUp Execution

Dec 1, 2023 · attack.credential_access attack.t1558.003 attack.lateral_movement attack.t1550.003 ·
Share on:

Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

Read More
HackTool - SafetyKatz Execution

Dec 1, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

Read More
Huawei BGP Authentication Failures

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Read More
Juniper BGP Missing MD5

Dec 1, 2023 · attack.initial_access attack.persistence attack.privilege_escalation attack.defense_evasion attack.credential_access attack.collection attack.t1078 attack.t1110 attack.t1557 ·
Share on:

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Read More
Microsoft IIS Service Account Password Dumped

Dec 1, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Read More
Mount Execution With Hidepid Parameter

Dec 1, 2023 · attack.credential_access attack.t1564 ·
Share on:

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

Read More
New Generic Credentials Added Via Cmdkey.EXE

Dec 1, 2023 · attack.credential_access attack.t1003.005 ·
Share on:

Detects usage of cmdkey to add generic credentials. As an example, this has to be used before connecting to an RDP session via command line interface.

Read More
Potential Credential Dumping Attempt Using New NetworkProvider - CLI

Dec 1, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Read More
Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE

Dec 1, 2023 · attack.credential_access attack.t1003.005 ·
Share on:

Detects usage of cmdkey to look for cached credentials on the system

Read More
SQLite Chromium Profile Data DB Access

Dec 1, 2023 · attack.credential_access attack.t1539 attack.t1555.003 attack.collection attack.t1005 ·
Share on:

Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.

Read More
SQLite Firefox Profile Data DB Access

Dec 1, 2023 · attack.credential_access attack.t1539 attack.collection attack.t1005 ·
Share on:

Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.

Read More
Suspicious Hacktool Execution - Imphash

Dec 1, 2023 · attack.credential_access attack.t1588.002 attack.t1003 ·
Share on:

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Read More
Suspicious Hacktool Execution - PE Metadata

Dec 1, 2023 · attack.credential_access attack.t1588.002 attack.t1003 ·
Share on:

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Read More
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities

Nov 20, 2023 · attack.credential_access attack.discovery attack.t1552 ·
Share on:

Detects execution of different log query utilities to search and dump the content of specific event logs or look for specific event IDs.

Read More
Findstr GPP Passwords

Nov 15, 2023 · attack.credential_access attack.t1552.006 ·
Share on:

Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

Read More
LSASS Process Reconnaissance Via Findstr.EXE

Nov 15, 2023 · attack.credential_access attack.t1552.006 ·
Share on:

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

Read More
Permission Misconfiguration Reconnaissance Via Findstr.EXE

Nov 15, 2023 · attack.credential_access attack.t1552.006 ·
Share on:

Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords. This is seen being used in combination with "icacls" to look for misconfigured files or folders permissions

Read More
NotPetya Ransomware Activity

Nov 10, 2023 · attack.defense_evasion attack.t1218.011 attack.t1070.001 attack.credential_access attack.t1003.001 car.2016-04-002 detection.emerging_threats ·
Share on:

Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

Read More
AADInternals PowerShell Cmdlets Execution - ProccessCreation

Nov 2, 2023 · attack.execution attack.reconnaissance attack.discovery attack.credential_access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
AADInternals PowerShell Cmdlets Execution - PsScript

Nov 2, 2023 · attack.execution attack.reconnaissance attack.discovery attack.credential_access attack.impact ·
Share on:

Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Read More
Browser Started with Remote Debugging

Nov 2, 2023 · attack.credential_access attack.t1185 ·
Share on:

Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks

Read More
Microsoft IIS Connection Strings Decryption

Nov 2, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

Read More
Potential Data Stealing Via Chromium Headless Debugging

Nov 2, 2023 · attack.credential_access attack.t1185 ·
Share on:

Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

Read More
Potential Keylogger Activity

Nov 2, 2023 · attack.collection attack.credential_access attack.t1056.001 ·
Share on:

Detects PowerShell scripts that contains reference to keystroke capturing functions

Read More
Potential Remote Credential Dumping Activity

Nov 2, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

Read More
Potential SAM Database Dump

Nov 2, 2023 · attack.credential_access attack.t1003.002 ·
Share on:

Detects the creation of files that look like exports of the local SAM (Security Account Manager)

Read More
Potential Suspicious Activity Using SeCEdit

Nov 2, 2023 · attack.discovery attack.persistence attack.defense_evasion attack.credential_access attack.privilege_escalation attack.t1562.002 attack.t1547.001 attack.t1505.005 attack.t1556.002 attack.t1562 attack.t1574.007 attack.t1564.002 attack.t1546.008 attack.t1546.007 attack.t1547.014 attack.t1547.010 attack.t1547.002 attack.t1557 attack.t1082 ·
Share on:

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Read More
Adding, Listing and Removing Credentials via Cmdkey CommandLine Ultility

Oct 30, 2023 · attack.credential_access attack.t1003.005 ·
Share on:

Detects the use of cmdkey to add, remove, or list credentials.

Read More
Access To Browser Credential Files By Uncommon Application

Oct 28, 2023 · attack.t1003 attack.credential_access ·
Share on:

Detects file access requests to browser credential stores by uncommon processes. Could indicate potential attempt of credential stealing. Requires heavy baselining before usage

Read More
Use of Legacy Authentication Protocols

Oct 28, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 ·
Share on:

Alert on when legacy authentication has been used on an account

Read More
New Okta User Created

Oct 28, 2023 · attack.credential_access ·
Share on:

Detects new user account creation

Read More
Okta 2023 Breach Indicator Of Compromise

Oct 28, 2023 · attack.credential_access detection.emerging_threats ·
Share on:

Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach. This rule can be enhanced by filtering out known and legitimate username used in your environnement.

Read More
Okta Admin Functions Access Through Proxy

Oct 28, 2023 · attack.credential_access ·
Share on:

Detects access to Okta admin functions through proxy.

Read More
Potential Okta Password in AlternateID Field

Oct 28, 2023 · attack.credential_access attack.t1552 ·
Share on:

Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files.

Read More
CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum

Oct 26, 2023 · attack.credential_access attack.t1566 attack.t1203 cve.2021.33771 cve.2021.31979 detection.emerging_threats ·
Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Read More
GALLIUM Artefacts - Builtin

Oct 26, 2023 · attack.credential_access attack.command_and_control attack.t1071 detection.emerging_threats ·
Share on:

Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

Read More
Potential SPN Enumeration Via Setspn.EXE

Oct 23, 2023 · attack.credential_access attack.t1558.003 ·
Share on:

Detects service principal name (SPN) enumeration used for Kerberoasting

Read More
LSASS Process Memory Dump Creation Via Taskmgr.EXE

Oct 19, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.

Read More
Active Directory Replication from Non Machine Account

Oct 18, 2023 · attack.credential_access attack.t1003.006 ·
Share on:

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

Read More
Anonymous IP Address

Oct 18, 2023 · attack.t1528 attack.credential_access ·
Share on:

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

Read More
Antivirus Password Dumper Detection

Oct 18, 2023 · attack.credential_access attack.t1003 attack.t1558 attack.t1003.001 attack.t1003.002 ·
Share on:

Detects a highly relevant Antivirus alert that reports a password dumper

Read More
Capture Credentials with Rpcping.exe

Oct 18, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

Read More
Cred Dump Tools Dropped Files

Oct 18, 2023 · attack.credential_access attack.t1003.001 attack.t1003.002 attack.t1003.003 attack.t1003.004 attack.t1003.005 ·
Share on:

Files with well-known filenames (parts of credential dump software or files produced by them) creation

Read More
CredUI.DLL Loaded By Uncommon Process

Oct 18, 2023 · attack.credential_access attack.collection attack.t1056.002 ·
Share on:

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

Read More
Enumeration for Credentials in Registry

Oct 18, 2023 · attack.credential_access attack.t1552.002 ·
Share on:

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services

Read More
External Remote RDP Logon from Public IP

Oct 18, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Read More
External Remote SMB Logon from Public IP

Oct 18, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Read More
GALLIUM IOCs

Oct 18, 2023 · attack.credential_access attack.command_and_control attack.t1212 attack.t1071 attack.g0093 detection.emerging_threats ·
Share on:

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

Read More
HackTool - Mimikatz Execution

Oct 18, 2023 · attack.credential_access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·
Share on:

Detection well-known mimikatz command line arguments

Read More
HackTool - Rubeus Execution

Oct 18, 2023 · attack.credential_access attack.t1003 attack.t1558.003 attack.lateral_movement attack.t1550.003 ·
Share on:

Detects the execution of the hacktool Rubeus via PE information of command line parameters

Read More
HackTool - Windows Credential Editor (WCE) Execution

Oct 18, 2023 · attack.credential_access attack.t1003.001 attack.s0005 ·
Share on:

Detects the use of Windows Credential Editor (WCE)

Read More
LSASS Dump Keyword In CommandLine

Oct 18, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

Read More
LSASS Memory Dump

Oct 18, 2023 · attack.credential_access attack.t1003.001 attack.s0002 ·
Share on:

Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.

Read More
MSSQL Server Failed Logon From External Network

Oct 18, 2023 · attack.credential_access attack.t1110 ·
Share on:

Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.

Read More
Possible Shadow Credentials Added

Oct 18, 2023 · attack.credential_access attack.t1556 ·
Share on:

Detects possible addition of shadow credentials to an active directory object.

Read More
Potential Browser Data Stealing

Oct 18, 2023 · attack.credential_access attack.t1555.003 ·
Share on:

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Read More
Potential Credential Dumping Attempt Using New NetworkProvider - REG

Oct 18, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Read More
Private Keys Reconnaissance Via CommandLine Tools

Oct 18, 2023 · attack.credential_access attack.t1552.004 ·
Share on:

Adversaries may search for private key certificate files on compromised systems for insecurely stored credential

Read More
Process Memory Dump Via Comsvcs.DLL

Oct 18, 2023 · attack.defense_evasion attack.credential_access attack.t1036 attack.t1003.001 car.2013-05-009 ·
Share on:

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

Read More
RottenPotato Like Attack Pattern

Oct 18, 2023 · attack.privilege_escalation attack.credential_access attack.t1557.001 ·
Share on:

Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

Read More
Shadow Copies Creation Using Operating Systems Utilities

Oct 18, 2023 · attack.credential_access attack.t1003 attack.t1003.002 attack.t1003.003 ·
Share on:

Shadow Copies creation using operating systems utilities, possible credential access

Read More
Suspicious Outbound Kerberos Connection

Oct 18, 2023 · attack.credential_access attack.t1558 attack.lateral_movement attack.t1550.003 ·
Share on:

Detects suspicious outbound network activity via kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Read More
Suspicious SYSTEM User Process Creation

Oct 18, 2023 · attack.credential_access attack.defense_evasion attack.privilege_escalation attack.t1134 attack.t1003 attack.t1027 ·
Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Read More
Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)

Oct 18, 2023 · attack.credential_access attack.t1003.003 ·
Share on:

Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.

Read More
Typical HiveNightmare SAM File Export

Oct 18, 2023 · attack.credential_access attack.t1552.001 cve.2021.36934 ·
Share on:

Detects files written by the different tools that exploit HiveNightmare

Read More
Added Owner To Application

Oct 17, 2023 · attack.t1552 attack.credential_access ·
Share on:

Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.

Read More
App Granted Microsoft Permissions

Oct 17, 2023 · attack.credential_access attack.t1528 ·
Share on:

Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

Read More
Application AppID Uri Configuration Changes

Oct 17, 2023 · attack.persistence attack.credential_access attack.privilege_escalation attack.t1552 attack.t1078.004 ·
Share on:

Detects when a configuration change is made to an applications AppID URI.

Read More
Application URI Configuration Changes

Oct 17, 2023 · attack.t1528 attack.t1078.004 attack.persistence attack.credential_access attack.privilege_escalation ·
Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Read More
Audit CVE Event

Oct 17, 2023 · attack.execution attack.t1203 attack.privilege_escalation attack.t1068 attack.defense_evasion attack.t1211 attack.credential_access attack.t1212 attack.lateral_movement attack.t1210 attack.impact attack.t1499.004 ·
Share on:

Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.

Read More
Azure AD Only Single Factor Authentication Required

Oct 17, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1556.006 ·
Share on:

Detect when users are authenticating without MFA being required.

Read More
Azure Key Vault Modified or Deleted

Oct 17, 2023 · attack.impact attack.credential_access attack.t1552 attack.t1552.001 ·
Share on:

Identifies when a key vault is modified or deleted.

Read More
Azure Keyvault Key Modified or Deleted

Oct 17, 2023 · attack.impact attack.credential_access attack.t1552 attack.t1552.001 ·
Share on:

Identifies when a Keyvault Key is modified or deleted in Azure.

Read More
Azure Keyvault Secrets Modified or Deleted

Oct 17, 2023 · attack.impact attack.credential_access attack.t1552 attack.t1552.001 ·
Share on:

Identifies when secrets are modified or deleted in Azure.

Read More
Azure Kubernetes Admission Controller

Oct 17, 2023 · attack.persistence attack.t1078 attack.credential_access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
Azure Kubernetes Network Policy Change

Oct 17, 2023 · attack.impact attack.credential_access ·
Share on:

Identifies when a Azure Kubernetes network policy is modified or deleted.

Read More
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted

Oct 17, 2023 · attack.impact attack.credential_access ·
Share on:

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Read More
CrackMapExec File Creation Patterns

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects suspicious file creation patterns found in logs when CrackMapExec is used

Read More
Credential Dumping Tools Service Execution - System

Oct 17, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:

Detects well-known credential dumping tools execution via service execution events

Read More
Delegated Permissions Granted For All Users

Oct 17, 2023 · attack.credential_access attack.t1528 ·
Share on:

Detects when highly privileged delegated permissions are granted on behalf of all users

Read More
End User Consent

Oct 17, 2023 · attack.credential_access attack.t1528 ·
Share on:

Detects when an end user consents to an application

Read More
End User Consent Blocked

Oct 17, 2023 · attack.credential_access attack.t1528 ·
Share on:

Detects when end user consent is blocked due to risk-based consent.

Read More
Enumeration for 3rd Party Creds From CLI

Oct 17, 2023 · attack.credential_access attack.t1552.002 ·
Share on:

Detects processes that query known 3rd party registry keys that holds credentials via commandline

Read More
Failed Authentications From Countries You Do Not Operate Out Of

Oct 17, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 ·
Share on:

Detect failed authentications from countries you do not operate out of.

Read More
Google Cloud Kubernetes Admission Controller

Oct 17, 2023 · attack.persistence attack.t1078 attack.credential_access attack.t1552 attack.t1552.007 ·
Share on:

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Read More
KrbRelayUp Attack Pattern

Oct 17, 2023 · attack.privilege_escalation attack.credential_access ·
Share on:

Detects logon events that have characteristics of events generated during an attack with KrbRelayUp and the like

Read More
Linux Recon Indicators

Oct 17, 2023 · attack.reconnaissance attack.t1592.004 attack.credential_access attack.t1552.001 ·
Share on:

Detects events with patterns found in commands used for reconnaissance on linux systems

Read More
LSASS Access Detected via Attack Surface Reduction

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects Access to LSASS Process

Read More
LSASS Access from Non System Account

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects potential mimikatz-like tools accessing LSASS from non system account

Read More
LSASS Process Dump Artefact In CrashDumps Folder

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.

Read More
Mimikatz DC Sync

Oct 17, 2023 · attack.credential_access attack.s0002 attack.t1003.006 ·
Share on:

Detects Mimikatz DC sync security events

Read More
Multifactor Authentication Interrupted

Oct 17, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 attack.t1621 ·
Share on:

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Read More
Ntdsutil Abuse

Oct 17, 2023 · attack.credential_access attack.t1003.003 ·
Share on:

Detects potential abuse of ntdsutil to dump ntds.dit database

Read More
Password Reset By User Account

Oct 17, 2023 · attack.persistence attack.credential_access attack.t1078.004 ·
Share on:

Detect when a user has reset their password in Azure AD

Read More
PetitPotam Suspicious Kerberos TGT Request

Oct 17, 2023 · attack.credential_access attack.t1187 ·
Share on:

Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.

Read More
Possible DC Shadow Attack

Oct 17, 2023 · attack.credential_access attack.t1207 ·
Share on:

Detects DCShadow via create new SPN

Read More
Possible Impacket SecretDump Remote Activity

Oct 17, 2023 · attack.credential_access attack.t1003.002 attack.t1003.004 attack.t1003.003 ·
Share on:

Detect AD credential dumping using impacket secretdump HKTL

Read More
Possible PetitPotam Coerce Authentication Attempt

Oct 17, 2023 · attack.credential_access attack.t1187 ·
Share on:

Detect PetitPotam coerced authentication activity.

Read More
Potential Credential Dumping Attempt Via PowerShell

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects PowerShell processes requesting access to "lsass.exe"

Read More
Potential Credential Dumping Attempt Via PowerShell Remote Thread

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects remote thread creation by PowerShell processes into "lsass.exe"

Read More
Potential Credential Dumping Via LSASS SilentProcessExit Technique

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process

Read More
Potential Credential Dumping Via WER

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass

Read More
Potential Credential Dumping Via WER - Application

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects Windows error reporting event where the process that crashed is lsass. This could be the cause of an intentional crash by techniques such as Lsass-Shtinkering to dump credential

Read More
Potential Invoke-Mimikatz PowerShell Script

Oct 17, 2023 · attack.credential_access attack.t1003 ·
Share on:

Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.

Read More
Powershell Install a DLL in System Directory

Oct 17, 2023 · attack.credential_access attack.t1556.002 ·
Share on:

Uses PowerShell to install/copy a a file into a system directory such as "System32" or "SysWOW64"

Read More
Process Access via TrolleyExpress Exclusion

Oct 17, 2023 · attack.defense_evasion attack.t1218.011 attack.credential_access attack.t1003.001 ·
Share on:

Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory

Read More
Rare GrantedAccess Flags on LSASS Access

Oct 17, 2023 · attack.credential_access attack.t1003.001 attack.s0002 ·
Share on:

Detects process access to LSASS memory with suspicious access flags 0x410 and 0x01410 (spin-off of similar rule)

Read More
Replay Attack Detected

Oct 17, 2023 · attack.credential_access attack.t1558 ·
Share on:

Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client

Read More
Sign-in Failure Due to Conditional Access Requirements Not Met

Oct 17, 2023 · attack.initial_access attack.credential_access attack.t1110 attack.t1078.004 ·
Share on:

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Read More
Successful Authentications From Countries You Do Not Operate Out Of

Oct 17, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 ·
Share on:

Detect successful authentications from countries you do not operate out of.

Read More
Suspicious File Event With Teams Objects

Oct 17, 2023 · attack.credential_access attack.t1528 ·
Share on:

Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.

Read More
Suspicious Kerberos RC4 Ticket Encryption

Oct 17, 2023 · attack.credential_access attack.t1558.003 ·
Share on:

Detects service ticket requests using RC4 encryption type

Read More
Suspicious LSASS Access Via MalSecLogon

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects suspicious access to Lsass handle via a call trace to "seclogon.dll"

Read More
Suspicious Office Token Search Via CLI

Oct 17, 2023 · attack.credential_access attack.t1528 ·
Share on:

Detects possible search for office tokens via CLI by looking for the string "eyJ0eX". This string is used as an anchor to look for the start of the JWT token used by office and similar apps.

Read More
Suspicious Serv-U Process Pattern

Oct 17, 2023 · attack.credential_access attack.t1555 cve.2021.35211 ·
Share on:

Detects a suspicious process pattern which could be a sign of an exploited Serv-U service

Read More
Suspicious Teams Application Related ObjectAcess Event

Oct 17, 2023 · attack.credential_access attack.t1528 ·
Share on:

Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.

Read More
User with Privileges Logon

Oct 17, 2023 · attack.defense_evasion attack.lateral_movement attack.credential_access attack.t1558 attack.t1649 attack.t1550 ·
Share on:

Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.

Read More
VSSAudit Security Event Source Registration

Oct 17, 2023 · attack.credential_access attack.t1003.002 ·
Share on:

Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.

Read More
WerFault LSASS Process Memory Dump

Oct 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials

Read More
Windows Credential Manager Access via VaultCmd

Oct 17, 2023 · attack.credential_access attack.t1555.004 ·
Share on:

List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe

Read More
Account Lockout

Oct 12, 2023 · attack.credential_access attack.t1110 ·
Share on:

Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.

Read More
AWS Route 53 Domain Transfer Lock Disabled

Oct 12, 2023 · attack.persistence attack.credential_access attack.t1098 ·
Share on:

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

Read More
AWS Route 53 Domain Transferred to Another Account

Oct 12, 2023 · attack.persistence attack.credential_access attack.t1098 ·
Share on:

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

Read More
Change to Authentication Method

Oct 12, 2023 · attack.credential_access attack.t1556 attack.persistence attack.defense_evasion attack.t1098 ·
Share on:

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Read More
Google Cloud Kubernetes RoleBinding

Oct 12, 2023 · attack.credential_access ·
Share on:

Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.

Read More
Google Cloud Kubernetes Secrets Modified or Deleted

Oct 12, 2023 · attack.credential_access ·
Share on:

Identifies when the Secrets are Modified or Deleted.

Read More
Multifactor Authentication Denied

Oct 12, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 attack.t1621 ·
Share on:

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Read More
Potential MFA Bypass Using Legacy Client Authentication

Oct 12, 2023 · attack.initial_access attack.credential_access attack.t1078.004 attack.t1110 ·
Share on:

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Read More
User Access Blocked by Azure Conditional Access

Oct 12, 2023 · attack.credential_access attack.initial_access attack.t1110 attack.t1078.004 ·
Share on:

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

Read More
Potentially Suspicious AccessMask Requested From LSASS

Oct 12, 2023 · attack.credential_access car.2019-04-004 attack.t1003.001 ·
Share on:

Detects process handle on LSASS process with certain access mask

Read More
MSSQL Server Failed Logon

Oct 11, 2023 · attack.credential_access attack.t1110 ·
Share on:

Detects failed logon attempts from clients to MSSQL server.

Read More
Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE

Oct 4, 2023 · attack.credential_access ·
Share on:

Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share

Read More
Time Travel Debugging Utility Usage - Image

Oct 4, 2023 · attack.defense_evasion attack.credential_access attack.t1218 attack.t1003.001 ·
Share on:

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

Read More
Unsigned Image Loaded Into LSASS Process

Oct 4, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Loading unsigned image (DLL, EXE) into LSASS process

Read More
Access To Windows Credential History File By Uncommon Application

Sep 15, 2023 · attack.credential_access attack.t1555.004 ·
Share on:

Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function

Read More
Access To Windows DPAPI Master Keys By Uncommon Application

Sep 15, 2023 · attack.credential_access attack.t1555.004 ·
Share on:

Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function

Read More
Credential Manager Access By Uncommon Application

Sep 15, 2023 · attack.t1003 attack.credential_access ·
Share on:

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Read More
LSASS Process Memory Dump Files

Sep 13, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

Read More
Primary Refresh Token Access Attempt

Sep 11, 2023 · attack.t1528 attack.credential_access ·
Share on:

Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft

Read More
Potential Credential Dumping Via LSASS Process Clone

Sep 7, 2023 · attack.credential_access attack.t1003 attack.t1003.001 ·
Share on:

Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity

Read More
Anomalous Token

Sep 6, 2023 · attack.t1528 attack.credential_access ·
Share on:

Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

Read More
Password Spray Activity

Sep 6, 2023 · attack.t1110 attack.credential_access ·
Share on:

Indicates that a password spray attack has been successfully performed.

Read More
SAML Token Issuer Anomaly

Sep 6, 2023 · attack.t1606 attack.credential_access ·
Share on:

Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns

Read More
Possible Impacket Secretsdump.py Activity

Sep 1, 2023 · attack.s0357 attack.credential_access attack.t1003 attack.t1003.003 attack.t1003.006 ·
Share on:

Detects attempts to retrieve/dump credentials using the DL_DRSGetNCChanges() method.

Read More
Certificate Exported Via PowerShell

Aug 28, 2023 · attack.credential_access attack.execution attack.t1552.004 attack.t1059.001 ·
Share on:

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Read More
HackTool - CrackMapExec Execution

Aug 28, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.credential_access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·
Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Read More
CVE-2021-31979 CVE-2021-33771 Exploits

Aug 17, 2023 · attack.credential_access attack.t1566 attack.t1203 cve.2021.33771 cve.2021.31979 detection.emerging_threats ·
Share on:

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Read More
Lsass Full Dump Request Via DumpType Registry Settings

Aug 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.

Read More
Credential Dumping Tools Service Execution

Aug 7, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:

Detects well-known credential dumping tools execution via service execution events

Read More
Credential Dumping Tools Service Execution - Security

Aug 7, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:

Detects well-known credential dumping tools execution via service execution events

Read More
HackTool - Credential Dumping Tools Named Pipe Created

Aug 7, 2023 · attack.credential_access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 ·
Share on:

Detects well-known credential dumping tools execution via specific named pipe creation

Read More
HackTool - Koh Default Named Pipe

Aug 7, 2023 · attack.privilege_escalation attack.credential_access attack.t1528 attack.t1134.001 ·
Share on:

Detects creation of default named pipes used by the Koh tool

Read More
Remote Thread Creation In Mstsc.Exe From Suspicious Location

Jul 28, 2023 · attack.credential_access ·
Share on:

Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.

Read More
PktMon.EXE Execution

Jul 13, 2023 · attack.credential_access attack.t1040 ·
Share on:

Detects execution of PktMon, a tool that captures network packets.

Read More
Credential Dumping Tools Accessing LSASS Memory

Jun 26, 2023 · attack.credential_access attack.t1003.001 attack.s0002 car.2019-04-004 ·
Share on:

Detects processes requesting access to LSASS memory via suspicious access masks. This is typical for credentials dumping tools

Read More
HackTool - Rubeus Execution - ScriptBlock

Jun 26, 2023 · attack.credential_access attack.t1003 attack.t1558.003 attack.lateral_movement attack.t1550.003 ·
Share on:

Detects the execution of the hacktool Rubeus using specific command line flags

Read More
LSASS Access From Program in Potentially Suspicious Folder

Jun 26, 2023 · attack.credential_access attack.t1003.001 attack.s0002 ·
Share on:

Detects process access to LSASS memory with suspicious access flags and from a potentially suspicious folder

Read More
Suspicious GrantedAccess Flags on LSASS Access

Jun 26, 2023 · attack.credential_access attack.t1003.001 attack.s0002 ·
Share on:

Detects process access to LSASS memory with suspicious access flags

Read More
Volume Shadow Copy Mount

Jun 21, 2023 · attack.credential_access attack.t1003.002 ·
Share on:

Detects volume shadow copy mount via Windows event log

Read More
APT31 Judgement Panda Activity

Jun 20, 2023 · attack.lateral_movement attack.credential_access attack.g0128 attack.t1003.001 attack.t1560.001 detection.emerging_threats ·
Share on:

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

Read More
CVE-2023-23397 Exploitation Attempt

Jun 20, 2023 · attack.credential_access attack.initial_access cve.2023.23397 detection.emerging_threats ·
Share on:

Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

Read More
Potential CVE-2021-42278 Exploitation Attempt

Jun 20, 2023 · attack.credential_access attack.t1558.003 cve.2021.42278 detection.emerging_threats ·
Share on:

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Read More
Potential Russian APT Credential Theft Activity

Jun 20, 2023 · attack.credential_access attack.t1552.001 attack.t1003.003 detection.emerging_threats ·
Share on:

Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike

Read More
Certificate Exported From Local Certificate Store

May 18, 2023 · attack.credential_access attack.t1649 ·
Share on:

Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.

Read More
Certificate Private Key Acquired

May 18, 2023 · attack.credential_access attack.t1649 ·
Share on:

Detects when an application acquires a certificate private key

Read More
Certificate Exported Via PowerShell - ScriptBlock

May 18, 2023 · attack.credential_access attack.t1552.004 ·
Share on:

Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Read More
HackTool - Dumpert Process Dumper Default File

May 15, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory

Read More
Potential LSASS Process Dump Via Procdump

May 15, 2023 · attack.defense_evasion attack.t1036 attack.credential_access attack.t1003.001 car.2013-05-009 ·
Share on:

Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process. This way we are also able to catch cases in which the attacker has renamed the procdump executable.

Read More
Suspicious Get-ADDBAccount Usage

May 15, 2023 · attack.credential_access attack.t1003.003 ·
Share on:

Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers

Read More
Abnormal LSASS Child and Parent Process Relationships (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects potential LSASS abuse based on unusual parent-child process lineage patterns. Part of the RedCanary 2023 Threat Detection Report.

Read More
Abnormal LSASS Process Access and Injection (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects suspicious cross-process events where LSASS is accessed. Part of the RedCanary 2023 Threat Detection Report.

Read More
LSASS Running Under Non-Privileged User Context (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects instances of LSASS running under any non-privileged user context, which can indicate abuse. Part of the RedCanary 2023 Threat Detection Report.

Read More
Rundll32 Dumping Credentials with MiniDump Function (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects processes that seem to be rundll32.exe along with a command line containing the term MiniDump. Part of the RedCanary 2023 Threat Detection Report.

Read More
NTDS.DIT Creation By Uncommon Parent Process

May 9, 2023 · attack.credential_access attack.t1003.003 ·
Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

Read More
Veeam Backup Servers Credential Dumping Script Execution

May 9, 2023 · attack.credential_access ·
Share on:

Detects execution of a PowerShell script that contains calls to the "Veeam.Backup" class, in order to dump stored credentials.

Read More
NTDS Exfiltration Filename Patterns

May 5, 2023 · attack.credential_access attack.t1003.003 ·
Share on:

Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.

Read More
NTDS.DIT Created

May 5, 2023 · attack.credential_access attack.t1003.003 ·
Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database)

Read More
NTDS.DIT Creation By Uncommon Process

May 5, 2023 · attack.credential_access attack.t1003.002 attack.t1003.003 ·
Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory

Read More
Remote Thread Created In KeePass.EXE

May 5, 2023 · attack.credential_access attack.t1555.005 ·
Share on:

Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity

Read More
Standard User In High Privileged Group

May 5, 2023 · attack.credential_access attack.privilege_escalation ·
Share on:

Detect standard users login that are part of high privileged groups such as the Administrator group

Read More
Credentials In Files - Linux

Apr 30, 2023 · attack.credential_access attack.t1552.001 ·
Share on:

Detecting attempts to extract passwords with grep

Read More
SAM Dump to AppData

Apr 30, 2023 · attack.credential_access attack.t1003.002 ·
Share on:

Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers

Read More
HackTool - Certify Execution

Apr 25, 2023 · attack.discovery attack.credential_access attack.t1649 ·
Share on:

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

Read More
Process Memory Dump via RdrLeakDiag.EXE

Apr 24, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory

Read More
Failed Logins with Different Accounts from Single Source - Linux

Apr 21, 2023 · attack.credential_access attack.t1110 ·
Share on:

Detects suspicious failed logins with different user accounts from a single source system

Read More
Sign-in Failure Bad Password Threshold

Apr 21, 2023 · attack.credential_access attack.t1110 ·
Share on:

Define a baseline threshold and then monitor and adjust to suit your organizational behaviors and limit false alerts from being generated.

Read More
Stored Credentials in Fake Files

Apr 21, 2023 · attack.credential_access attack.t1555 ·
Share on:

Search for accessing of fake files with stored credentials

Read More
HackTool - Certipy Execution

Apr 21, 2023 · attack.discovery attack.credential_access attack.t1649 ·
Share on:

Detects Certipy a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

Read More
Possible Impacket GetUserSPNs Activity

Apr 16, 2023 · attack.s0357 attack.credential_access attack.t1558 attack.t1558.003 ·
Share on:

Detects attempts to create vulnerable Kerberos Ticket Granting Service (TGS) tickets using the RC4-HMAC encryption type.

Read More
Potential CVE-2021-42287 Exploitation Attempt

Apr 14, 2023 · attack.credential_access attack.t1558.003 ·
Share on:

The attacker creates a computer object using those permissions with a password known to her. After that she clears the attribute ServicePrincipalName on the computer object. Because she created the object (CREATOR OWNER), she gets granted additional permissions and can do many changes to the object.

Read More
QuarksPwDump Clearing Access History

Apr 14, 2023 · attack.credential_access attack.t1003.002 ·
Share on:

Detects QuarksPwDump clearing access history in hive

Read More
Windows Pcap Drivers

Apr 14, 2023 · attack.discovery attack.credential_access attack.t1040 ·
Share on:

Detects Windows Pcap driver installation based on a list of associated .sys files.

Read More
Suspicious Rejected SMB Guest Logon From IP

Apr 11, 2023 · attack.credential_access attack.t1110.001 ·
Share on:

Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service

Read More
Suspicious Dump64.exe Execution

Mar 24, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects when a user bypasses Defender by renaming a tool to dump64.exe and placing it in a Visual Studio folder

Read More
Suspicious Network Communication With IPFS

Mar 24, 2023 · attack.credential_access attack.t1056 ·
Share on:

Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.

Read More
Suspicious Active Directory Database Snapshot Via ADExplorer

Mar 15, 2023 · attack.credential_access attack.t1552.001 attack.t1003.003 ·
Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory.

Read More
DPAPI Domain Master Key Backup Attempt

Mar 15, 2023 · attack.credential_access attack.t1003.004 ·
Share on:

Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.

Read More
Active Directory Database Snapshot Via ADExplorer

Mar 14, 2023 · attack.credential_access attack.t1552.001 attack.t1003.003 ·
Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database.

Read More
Load Of Dbghelp/Dbgcore DLL From Suspicious Process

Mar 9, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecraft use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.

Read More
VolumeShadowCopy Symlink Creation Via Mklink

Mar 7, 2023 · attack.credential_access attack.t1003.002 attack.t1003.003 ·
Share on:

Shadow Copies storage symbolic link creation using operating systems utilities

Read More
Copying Sensitive Files with Credential Data

Mar 5, 2023 · attack.credential_access attack.t1003.002 attack.t1003.003 car.2013-07-001 attack.s0404 ·
Share on:

Files with well-known filenames (sensitive files with credential data) copying

Read More
Dropping Of Password Filter DLL

Mar 5, 2023 · attack.credential_access attack.t1556.002 ·
Share on:

Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

Read More
Suspicious NTLM Authentication on the Printer Spooler Service

Mar 2, 2023 · attack.privilege_escalation attack.credential_access attack.t1212 ·
Share on:

Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service

Read More
Transferring Files with Credential Data via Network Shares

Feb 27, 2023 · attack.credential_access attack.t1003.002 attack.t1003.001 attack.t1003.003 ·
Share on:

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Read More
Automated Collection Command Prompt

Feb 21, 2023 · attack.collection attack.t1119 attack.credential_access attack.t1552.001 ·
Share on:

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Read More
Esentutl Gather Credentials

Feb 21, 2023 · attack.credential_access attack.t1003 attack.t1003.003 ·
Share on:

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Read More
Potential Network Sniffing Activity Using Network Tools

Feb 21, 2023 · attack.credential_access attack.discovery attack.t1040 ·
Share on:

Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Read More
PowerShell Get-Process LSASS

Feb 21, 2023 · attack.credential_access attack.t1552.004 ·
Share on:

Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity

Read More
PowerShell SAM Copy

Feb 21, 2023 · attack.credential_access attack.t1003.002 ·
Share on:

Detects suspicious PowerShell scripts accessing SAM hives

Read More
PUA - DIT Snapshot Viewer

Feb 21, 2023 · attack.credential_access attack.t1003.003 ·
Share on:

Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.

Read More
PUA - Mouse Lock Execution

Feb 21, 2023 · attack.credential_access attack.collection attack.t1056.002 ·
Share on:

In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.

Read More
Suspicious Key Manager Access

Feb 21, 2023 · attack.credential_access attack.t1555.004 ·
Share on:

Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)

Read More
Suspicious Reg Add Open Command

Feb 21, 2023 · attack.credential_access attack.t1003 ·
Share on:

Threat actors performed dumping of SAM, SECURITY and SYSTEM registry hives using DelegateExecute key

Read More
Mimikatz Kirbi File Creation

Feb 17, 2023 · attack.credential_access attack.t1558 ·
Share on:

Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

Read More
QuarksPwDump Dump File

Feb 17, 2023 · attack.credential_access attack.t1003.002 ·
Share on:

Detects a dump file written by QuarksPwDump password dumper

Read More
SafetyKatz Default Dump Filename

Feb 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects default lsass dump filename from SafetyKatz

Read More
Suspicious Renamed Comsvcs DLL Loaded By Rundll32

Feb 17, 2023 · attack.credential_access attack.defense_evasion attack.t1003.001 ·
Share on:

Detects rundll32 loading a renamed comsvcs.dll to dump process memory

Read More
Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded

Feb 17, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.

Read More
PUA - WebBrowserPassView Execution

Feb 16, 2023 · attack.credential_access attack.t1555.003 ·
Share on:

Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera

Read More
Potential Windows Defender Tampering Via Wmic.EXE

Feb 14, 2023 · attack.credential_access attack.t1546.008 ·
Share on:

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

Read More
HackTool - CrackMapExec Process Patterns

Feb 13, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects suspicious process patterns found in logs when CrackMapExec is used

Read More
Harvesting Of Wifi Credentials Via Netsh.EXE

Feb 13, 2023 · attack.discovery attack.credential_access attack.t1040 ·
Share on:

Detect the harvesting of wifi credentials using netsh.exe

Read More
New Network Trace Capture Started Via Netsh.EXE

Feb 13, 2023 · attack.discovery attack.credential_access attack.t1040 ·
Share on:

Detects the execution of netsh with the "trace" flag in order to start a network capture

Read More
DPAPI Domain Backup Key Extraction

Feb 7, 2023 · attack.credential_access attack.t1003.004 ·
Share on:

Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers

Read More
SAM Registry Hive Handle Request

Feb 7, 2023 · attack.discovery attack.t1012 attack.credential_access attack.t1552.002 ·
Share on:

Detects handles requested to SAM registry hive

Read More
Suspicious PFX File Creation

Feb 7, 2023 · attack.credential_access attack.t1552.004 ·
Share on:

A general detection for processes creating PFX files. This could be an indicator of an adversary exporting a local certificate to a PFX file.

Read More
Dumping of Sensitive Hives Via Reg.EXE

Feb 7, 2023 · attack.credential_access attack.t1003.002 attack.t1003.004 attack.t1003.005 car.2013-07-001 ·
Share on:

Detects the usage of "reg.exe" in order to dump sensitive registry hives, which includes SAM, SYSTEM and SECURITY

Read More
Suspicious Command With Teams Objects Paths

Feb 6, 2023 · attack.credential_access attack.t1528 ·
Share on:

Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.

Read More
HackTool - Pypykatz Credentials Dumping Activity

Feb 6, 2023 · attack.credential_access attack.t1003.002 ·
Share on:

Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

Read More
HackTool - Quarks PwDump Execution

Feb 5, 2023 · attack.credential_access attack.t1003.002 ·
Share on:

Detects usage of the Quarks PwDump tool via commandline arguments

Read More
HackTool - ADCSPwn Execution

Feb 4, 2023 · attack.credential_access attack.t1557.001 ·
Share on:

Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

Read More
HackTool - CreateMiniDump Execution

Feb 4, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

Read More
HackTool - Dumpert Process Dumper Execution

Feb 4, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

Read More
HackTool - Hashcat Password Cracker Execution

Feb 4, 2023 · attack.credential_access attack.t1110.002 ·
Share on:

Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

Read More
HackTool - Hydra Password Bruteforce Execution

Feb 4, 2023 · attack.credential_access attack.t1110 attack.t1110.001 ·
Share on:

Detects command line parameters used by Hydra password guessing hack tool

Read More
HackTool - SecurityXploded Execution

Feb 4, 2023 · attack.credential_access attack.t1555 ·
Share on:

Detects the execution of SecurityXploded Tools

Read More
Credentials from Password Stores - Keychain

Feb 1, 2023 · attack.credential_access attack.t1555.001 ·
Share on:

Detects passwords dumps from Keychain

Read More
Guacamole Two Users Sharing Session Anomaly

Feb 1, 2023 · attack.credential_access attack.t1212 ·
Share on:

Detects suspicious session with two users present

Read More
Hack Tool User Agent

Feb 1, 2023 · attack.initial_access attack.t1190 attack.credential_access attack.t1110 ·
Share on:

Detects suspicious user agent strings user by hack tools in proxy logs

Read More
iOS Implant URL Pattern

Feb 1, 2023 · attack.execution attack.t1203 attack.collection attack.t1005 attack.t1119 attack.credential_access attack.t1528 attack.t1552.001 ·
Share on:

Detects URL pattern used by iOS Implant

Read More
Kerberos Manipulation

Feb 1, 2023 · attack.credential_access attack.t1212 ·
Share on:

This method triggers on rare Kerberos Failure Codes caused by manipulations of Kerberos messages

Read More
LSASS Access from White-Listed Processes

Feb 1, 2023 · attack.credential_access attack.t1003.001 attack.s0002 ·
Share on:

Detects a possible process memory dump that uses the white-listed filename like TrolleyExpress.exe as a way to dump the lsass process memory without Microsoft Defender interference

Read More
LSASS Memory Access by Tool Named Dump

Feb 1, 2023 · attack.credential_access attack.t1003.001 attack.s0002 ·
Share on:

Detects a possible process memory dump based on a keyword in the file name of the accessing process

Read More
Mimikatz Use

Feb 1, 2023 · attack.s0002 attack.lateral_movement attack.credential_access car.2013-07-001 car.2019-04-004 attack.t1003.002 attack.t1003.004 attack.t1003.001 attack.t1003.006 ·
Share on:

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Read More
NPPSpy Hacktool Usage

Feb 1, 2023 · attack.credential_access ·
Share on:

Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file

Read More
PowerShell Credential Prompt

Feb 1, 2023 · attack.credential_access attack.execution attack.t1059.001 ·
Share on:

Detects PowerShell calling a credential prompt

Read More
PowerShell Get-Process LSASS in ScriptBlock

Feb 1, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity

Read More
WerFault Accassing LSASS

Feb 1, 2023 · attack.credential_access attack.t1003.001 attack.s0002 ·
Share on:

Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.

Read More
Windows Credential Editor Registry

Feb 1, 2023 · attack.credential_access attack.t1003.001 attack.s0005 ·
Share on:

Detects the use of Windows Credential Editor (WCE)

Read More
Access to Browser Login Data

Jan 27, 2023 · attack.credential_access attack.t1555.003 ·
Share on:

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Read More
Create Volume Shadow Copy with Powershell

Jan 27, 2023 · attack.credential_access attack.t1003.003 ·
Share on:

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information

Read More
NTLM Brute Force

Jan 27, 2023 · attack.credential_access attack.t1110 ·
Share on:

Detects common NTLM brute force device names

Read More
Request A Single Ticket via PowerShell

Jan 27, 2023 · attack.credential_access attack.t1558.003 ·
Share on:

utilize native PowerShell Identity modules to query the domain to extract the Service Principal Names for a single computer. This behavior is typically used during a kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.

Read More
Suspicious Connection to Remote Account

Jan 27, 2023 · attack.credential_access attack.t1110.001 ·
Share on:

Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism

Read More
Suspicious Get-ADReplAccount

Jan 27, 2023 · attack.credential_access attack.t1003.006 ·
Share on:

The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

Read More
External Remote Service Logon from Public IP

Jan 23, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via RDP, SMB, etc. This can indicate a publicly-exposed RDP or SMB port.

Read More
Okta MFA Reset or Deactivated

Jan 12, 2023 · attack.persistence attack.credential_access attack.defense_evasion attack.t1556.006 ·
Share on:

Detects when an attempt at deactivating or resetting MFA.

Read More
Linux Keylogging with Pam.d

Jan 10, 2023 · attack.credential_access attack.t1003 attack.t1056.001 ·
Share on:

Detect attempt to enable auditing of TTY input

Read More
Lazagne dumping credentials

Jan 8, 2023 · attack.credential_access attack.t1555 ·
Share on:

Detects the use of lazagne using command line execution.

Read More
Mimikatz Command Line With Ticket Export

Jan 8, 2023 · attack.credential_access attack.t1003 attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·
Share on:

Detection of well-known mimikatz command line arguments. Added more commandline indicators from referenced rule by author - Teymur Kheirkhabarov, oscd.community

Read More
Cisco Collect Data

Jan 4, 2023 · attack.discovery attack.credential_access attack.collection attack.t1087.001 attack.t1552.001 attack.t1005 ·
Share on:

Collect pertinent data from the configuration files

Read More
Cisco Crypto Commands

Jan 4, 2023 · attack.credential_access attack.defense_evasion attack.t1553.004 attack.t1552.004 ·
Share on:

Show when private keys are being exported from the device, or when new certificates are installed

Read More
Cisco Show Commands Input

Jan 4, 2023 · attack.credential_access attack.t1552.003 ·
Share on:

See what commands are being input into the device by other people, full credentials can be in the history

Read More
Cisco Sniffing

Jan 4, 2023 · attack.credential_access attack.discovery attack.t1040 ·
Share on:

Show when a monitor or a span/rspan is setup or modified

Read More
Dump Credentials from Windows Credential Manager With PowerShell

Jan 4, 2023 · attack.credential_access attack.t1555 ·
Share on:

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Read More
Enumerate Credentials from Windows Credential Manager With PowerShell

Jan 4, 2023 · attack.credential_access attack.t1555 ·
Share on:

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Read More
Extracting Information with PowerShell

Jan 4, 2023 · attack.credential_access attack.t1552.001 ·
Share on:

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Read More
Transferring Files with Credential Data via Network Shares - Zeek

Dec 27, 2022 · attack.credential_access attack.t1003.002 attack.t1003.001 attack.t1003.003 ·
Share on:

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Read More
ADCS Certificate Template Configuration Vulnerability

Dec 27, 2022 · attack.privilege_escalation attack.credential_access ·
Share on:

Detects certificate creation with template allowing risk permission subject

Read More
ADCS Certificate Template Configuration Vulnerability with Risky EKU

Dec 27, 2022 · attack.privilege_escalation attack.credential_access ·
Share on:

Detects certificate creation with template allowing risk permission subject and risky EKU

Read More
Esentutl Volume Shadow Copy Service Keys

Dec 27, 2022 · attack.credential_access attack.t1003.002 ·
Share on:

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\System\CurrentControlSet\Services\VSS\Diag\VolSnap\Volume are captured.

Read More
GUI Input Capture - macOS

Dec 27, 2022 · attack.credential_access attack.t1056.002 ·
Share on:

Detects attempts to use system dialog prompts to capture user credentials

Read More
Suspicious Unattend.xml File Access

Dec 27, 2022 · attack.credential_access attack.t1552.001 ·
Share on:

Attempts to access unattend.xml, where credentials are commonly stored, within the Panther directory where installation logs are stored. If these files exist, their contents will be displayed. They are used to store credentials/answers during the unattended windows install process

Read More
Network Sniffing - Linux

Dec 18, 2022 · attack.credential_access attack.discovery attack.t1040 ·
Share on:

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Read More
Suspicious History File Operations - Linux

Nov 29, 2022 · attack.credential_access attack.t1552.003 ·
Share on:

Detects commandline operations on shell history files

Read More
NTDSutil Pulling of NTDS.dit File

Nov 29, 2022 · attack.credential_access attack.t1003 attack.t1003.003 ·
Share on:

Detects use of the ntdsutil utility to pull ntds.dit (Active Directory database).

Read More
Network Sniffing - MacOs

Nov 27, 2022 · attack.discovery attack.credential_access attack.t1040 ·
Share on:

Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Read More
Abnormal LSASS Child and Parent Process Relationships

Nov 9, 2022 · attack.credential_access attack.t1003.001 ·
Share on:

Detects potential lsass.exe abuse based on unusual and suspicious parent-child relationships. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Abnormal LSASS Process Access and Injection

Nov 9, 2022 · attack.credential_access attack.t1003.001 ·
Share on:

Detects obviously suspicious cross-process events targetting lsass.exe. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Dumping Process via Sqldumper.exe

Oct 28, 2022 · attack.credential_access attack.t1003.001 ·
Share on:

Detects process dump via legitimate sqldumper.exe binary

Read More
Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)

Oct 28, 2022 · attack.credential_access attack.t1003.003 ·
Share on:

Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)

Read More
Suspicious SYSVOL Domain Group Policy Access

Oct 28, 2022 · attack.credential_access attack.t1552.006 ·
Share on:

Detects Access to Domain Group Policies stored in SYSVOL

Read More
Credential Dumping by LaZagne

Oct 26, 2022 · attack.credential_access attack.t1003.001 attack.s0349 ·
Share on:

Detects LSASS process access by LaZagne for credential dumping.

Read More
Mimikatz through Windows Remote Management

Oct 26, 2022 · attack.credential_access attack.execution attack.t1003.001 attack.t1059.001 attack.lateral_movement attack.t1021.006 attack.s0002 ·
Share on:

Detects usage of mimikatz through WinRM protocol by monitoring access to lsass process by wsmprovhost.exe.

Read More
Password Dumper Remote Thread in LSASS

Oct 25, 2022 · attack.credential_access attack.s0005 attack.t1003.001 ·
Share on:

Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.

Read More
WCE wceaux.dll Access

Oct 25, 2022 · attack.credential_access attack.t1003 attack.s0005 ·
Share on:

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

Read More
Credentials In Files

Oct 25, 2022 · attack.credential_access attack.t1552.001 ·
Share on:

Detecting attempts to extract passwords with grep and laZagne

Read More
Kerberos Network Traffic RC4 Ticket Encryption

Oct 25, 2022 · attack.credential_access attack.t1558.003 ·
Share on:

Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting

Read More
Possible Impacket SecretDump Remote Activity - Zeek

Oct 25, 2022 · attack.credential_access attack.t1003.002 attack.t1003.004 attack.t1003.003 ·
Share on:

Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

Read More
Suspicious History File Operations

Oct 25, 2022 · attack.credential_access attack.t1552.003 ·
Share on:

Detects commandline operations on shell history files

Read More
Password Dumper Activity on LSASS

Oct 14, 2022 · attack.credential_access attack.t1003.001 ·
Share on:

Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN

Read More
Time Travel Debugging Utility Usage

Oct 9, 2022 · attack.defense_evasion attack.credential_access attack.t1218 attack.t1003.001 ·
Share on:

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

Read More
Credential Dumping by Pypykatz

Oct 9, 2022 · attack.credential_access attack.t1003.001 ·
Share on:

Detects LSASS process access by pypykatz for credential dumping.

Read More
Lsass Memory Dump via Comsvcs DLL

Oct 9, 2022 · attack.credential_access attack.t1003.001 ·
Share on:

Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.

Read More
Using Lazagne to dump credentials

May 9, 2022 · attack.credential_access attack.t1555 ·
Share on:

Detects the use of lazagne looking into the command line execution.

Read More