attack.t1003.004 | Detection.FYI

Credential Dumping Tools Service Execution - System
Apr 14, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:
Detects well-known credential dumping tools execution via service execution events

Read More
DPAPI Domain Master Key Backup Attempt
Mar 15, 2023 · attack.credential_access attack.t1003.004 ·
Share on:
Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.

Read More
HackTool - Mimikatz Execution
Feb 22, 2023 · attack.credential_access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·
Share on:
Detection well-known mimikatz command line arguments

Read More
DPAPI Domain Backup Key Extraction
Feb 7, 2023 · attack.credential_access attack.t1003.004 ·
Share on:
Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers

Read More
Dumping of Sensitive Hives Via Reg.EXE
Feb 7, 2023 · attack.credential_access attack.t1003.002 attack.t1003.004 attack.t1003.005 car.2013-07-001 ·
Share on:
Detects the usage of "reg.exe" in order to dump sensitive registry hives, which includes SAM, SYSTEM and SECURITY

Read More
Credential Dumping Tools Service Execution
Feb 1, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:
Detects well-known credential dumping tools execution via service execution events

Read More
Credential Dumping Tools Service Execution - Security
Feb 1, 2023 · attack.credential_access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·
Share on:
Detects well-known credential dumping tools execution via service execution events

Read More
Mimikatz Use
Feb 1, 2023 · attack.s0002 attack.lateral_movement attack.credential_access car.2013-07-001 car.2019-04-004 attack.t1003.002 attack.t1003.004 attack.t1003.001 attack.t1003.006 ·
Share on:
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Read More
Mimikatz Command Line With Ticket Export
Jan 8, 2023 · attack.credential_access attack.t1003 attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·
Share on:
Detection of well-known mimikatz command line arguments. Added more commandline indicators from referenced rule by author - Teymur Kheirkhabarov, oscd.community

Read More
Cred Dump Tools Dropped Files
Oct 26, 2022 · attack.credential_access attack.t1003.001 attack.t1003.002 attack.t1003.003 attack.t1003.004 attack.t1003.005 ·
Share on:
Files with well-known filenames (parts of credential dump software or files produced by them) creation

Read More
Cred Dump-Tools Named Pipes
Oct 25, 2022 · attack.credential_access attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 ·
Share on:
Detects well-known credential dumping tools execution via specific named pipes

Read More
Possible Impacket SecretDump Remote Activity
Oct 25, 2022 · attack.credential_access attack.t1003.002 attack.t1003.004 attack.t1003.003 ·
Share on:
Detect AD credential dumping using impacket secretdump HKTL

Read More
Possible Impacket SecretDump Remote Activity - Zeek
Oct 25, 2022 · attack.credential_access attack.t1003.002 attack.t1003.004 attack.t1003.003 ·
Share on:
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

Read More