attack.t1003

Microsoft IIS Service Account Password Dumped

Dec 1, 2023 · attack.credential_access attack.t1003 ·

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Potential Credential Dumping Attempt Using New NetworkProvider - CLI

Dec 1, 2023 · attack.credential_access attack.t1003 ·

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Suspicious Hacktool Execution - Imphash

Dec 1, 2023 · attack.credential_access attack.t1588.002 attack.t1003 ·

Share on:

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Suspicious Hacktool Execution - PE Metadata

Dec 1, 2023 · attack.credential_access attack.t1588.002 attack.t1003 ·

Share on:

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Microsoft IIS Connection Strings Decryption

Nov 2, 2023 · attack.credential_access attack.t1003 ·

Share on:

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

Potential Remote Credential Dumping Activity

Nov 2, 2023 · attack.credential_access attack.t1003 ·

Share on:

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

Access To Browser Credential Files By Uncommon Application

Oct 28, 2023 · attack.t1003 attack.credential_access ·

Share on:

Detects file access requests to browser credential stores by uncommon processes. Could indicate potential attempt of credential stealing. Requires heavy baselining before usage

Antivirus Password Dumper Detection

Oct 18, 2023 · attack.credential_access attack.t1003 attack.t1558 attack.t1003.001 attack.t1003.002 ·

Share on:

Detects a highly relevant Antivirus alert that reports a password dumper

Capture Credentials with Rpcping.exe

Oct 18, 2023 · attack.credential_access attack.t1003 ·

Share on:

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

HackTool - Rubeus Execution

Oct 18, 2023 · attack.credential_access attack.t1003 attack.t1558.003 attack.lateral_movement attack.t1550.003 ·

Share on:

Detects the execution of the hacktool Rubeus via PE information of command line parameters

Potential Credential Dumping Attempt Using New NetworkProvider - REG

Oct 18, 2023 · attack.credential_access attack.t1003 ·

Share on:

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Shadow Copies Creation Using Operating Systems Utilities

Oct 18, 2023 · attack.credential_access attack.t1003 attack.t1003.002 attack.t1003.003 ·

Share on:

Shadow Copies creation using operating systems utilities, possible credential access

Suspicious SYSTEM User Process Creation

Oct 18, 2023 · attack.credential_access attack.defense_evasion attack.privilege_escalation attack.t1134 attack.t1003 attack.t1027 ·

Share on:

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Potential Invoke-Mimikatz PowerShell Script

Oct 17, 2023 · attack.credential_access attack.t1003 ·

Share on:

Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.

Rare Subscription-level Operations In Azure

Oct 12, 2023 · attack.t1003 ·

Share on:

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

Credential Manager Access By Uncommon Application

Sep 15, 2023 · attack.t1003 attack.credential_access ·

Share on:

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Potential Credential Dumping Via LSASS Process Clone

Sep 7, 2023 · attack.credential_access attack.t1003 attack.t1003.001 ·

Share on:

Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity

Possible Impacket Secretsdump.py Activity

Sep 1, 2023 · attack.s0357 attack.credential_access attack.t1003 attack.t1003.003 attack.t1003.006 ·

Share on:

Detects attempts to retrieve/dump credentials using the DL_DRSGetNCChanges() method.

Potentially Suspicious ODBC Driver Registered

Aug 17, 2023 · attack.persistence attack.t1003 ·

Share on:

Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location

HackTool - Rubeus Execution - ScriptBlock

Jun 26, 2023 · attack.credential_access attack.t1003 attack.t1558.003 attack.lateral_movement attack.t1550.003 ·

Share on:

Detects the execution of the hacktool Rubeus using specific command line flags

Malicious Service Installations

Apr 21, 2023 · attack.persistence attack.privilege_escalation attack.t1003 attack.t1035 attack.t1050 car.2013-09-005 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.

Esentutl Gather Credentials

Feb 21, 2023 · attack.credential_access attack.t1003 attack.t1003.003 ·

Share on:

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Suspicious Reg Add Open Command

Feb 21, 2023 · attack.credential_access attack.t1003 ·

Share on:

Threat actors performed dumping of SAM, SECURITY and SYSTEM registry hives using DelegateExecute key

Live Memory Dump Using Powershell

Feb 1, 2023 · attack.t1003 ·

Share on:

Detects usage of a PowerShell command to dump the live memory of a Windows machine

Malicious Service Installations

Feb 1, 2023 · attack.persistence attack.privilege_escalation attack.t1003 car.2013-09-005 attack.t1543.003 attack.t1569.002 ·

Share on:

Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.

Linux Keylogging with Pam.d

Jan 10, 2023 · attack.credential_access attack.t1003 attack.t1056.001 ·

Share on:

Detect attempt to enable auditing of TTY input

Mimikatz Command Line With Ticket Export

Jan 8, 2023 · attack.credential_access attack.t1003 attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·

Share on:

Detection of well-known mimikatz command line arguments. Added more commandline indicators from referenced rule by author - Teymur Kheirkhabarov, oscd.community

NTDSutil Pulling of NTDS.dit File

Nov 29, 2022 · attack.credential_access attack.t1003 attack.t1003.003 ·

Share on:

Detects use of the ntdsutil utility to pull ntds.dit (Active Directory database).

WCE wceaux.dll Access

Oct 25, 2022 · attack.credential_access attack.t1003 attack.s0005 ·

Share on:

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host