attack.t1003.002

Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.

Dumping of Sensitive Hives Via Reg.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.004 attack.t1003.005 car.2013-07-001 ·

Share on:

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

Esentutl Volume Shadow Copy Service Keys

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\System\CurrentControlSet\Services\VSS\Diag\VolSnap\Volume are captured.

HackTool - Credential Dumping Tools Named Pipe Created

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 ·

Share on:

Detects well-known credential dumping tools execution via specific named pipe creation

HackTool - Mimikatz Execution

Aug 12, 2024 · attack.credential-access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·

Share on:

Detection well-known mimikatz command line arguments

HackTool - Pypykatz Credentials Dumping Activity

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

HackTool - Quarks PwDump Execution

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects usage of the Quarks PwDump tool via commandline arguments

HackTool - QuarksPwDump Dump File

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects a dump file written by QuarksPwDump password dumper

Mimikatz Use

Aug 12, 2024 · attack.s0002 attack.lateral-movement attack.credential-access car.2013-07-001 car.2019-04-004 attack.t1003.002 attack.t1003.004 attack.t1003.001 attack.t1003.006 ·

Share on:

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

NTDS.DIT Creation By Uncommon Process

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 ·

Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory

Possible Impacket SecretDump Remote Activity

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.004 attack.t1003.003 ·

Share on:

Detect AD credential dumping using impacket secretdump HKTL

Possible Impacket SecretDump Remote Activity - Zeek

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.004 attack.t1003.003 ·

Share on:

Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

PowerShell SAM Copy

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects suspicious PowerShell scripts accessing SAM hives

Shadow Copies Creation Using Operating Systems Utilities

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.002 attack.t1003.003 ·

Share on:

Shadow Copies creation using operating systems utilities, possible credential access

Transferring Files with Credential Data via Network Shares

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.001 attack.t1003.003 ·

Share on:

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Transferring Files with Credential Data via Network Shares - Zeek

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.001 attack.t1003.003 ·

Share on:

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Volume Shadow Copy Mount

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects volume shadow copy mount via Windows event log

VolumeShadowCopy Symlink Creation Via Mklink

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 ·

Share on:

Shadow Copies storage symbolic link creation using operating systems utilities

VSSAudit Security Event Source Registration

Aug 12, 2024 · attack.credential-access attack.t1003.002 ·

Share on:

Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.

Mimikatz Command Line With Ticket Export

Jan 8, 2023 · attack.credential_access attack.t1003 attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·

Share on:

Detection of well-known mimikatz command line arguments. Added more commandline indicators from referenced rule by author - Teymur Kheirkhabarov, oscd.community