| elastic |
Suspicious /proc/maps Discovery |
production |
2026-10-09 |
| splunk |
Enable WDigest UseLogonCredential Registry |
production |
2026-10-09 |
| elastic |
Potential Credential Access via DCSync |
production |
2026-10-06 |
| elastic |
Suspicious Execution via Windows Subsystem for Linux |
production |
2026-10-06 |
| elastic |
Access to a Sensitive LDAP Attribute |
production |
2026-10-06 |
| elastic |
Suspicious Lsass Process Access |
production |
2026-10-05 |
| splunk |
Attacker Tools On Endpoint |
production |
2026-09-22 |
| elastic |
LSASS Process Access via Windows API |
production |
2026-09-22 |
| elastic |
Symbolic Link to Shadow Copy Created |
production |
2026-09-18 |
| elastic |
Potential Linux Credential Dumping via Proc Filesystem |
production |
2026-09-18 |
| elastic |
Segfault from Sensitive Process Detected |
production |
2026-09-18 |
| elastic |
Suspicious Execution from Foomatic-rip or Cupsd Parent |
production |
2026-09-18 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Potential Unauthorized Access via Wildcard Injection Detected |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Linux DAC permissions |
production |
2026-09-18 |
| elastic |
Suspicious Symbolic Link Created |
production |
2026-09-18 |
| elastic |
Potential Shadow File Read via Command Line Utilities |
production |
2026-09-18 |
| elastic |
Dumping Account Hashes via Built-In Commands |
production |
2026-09-18 |
| elastic |
Kerberos Cached Credentials Dumping |
production |
2026-09-18 |
| elastic |
Credential Dumping - Detected - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Credential Dumping - Prevented - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Windows Utilities |
production |
2026-09-18 |
| elastic |
NTDS or SAM Database File Copied |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Trusted Developer Utility |
production |
2026-09-18 |
| elastic |
First Time Seen Account Performing DCSync |
production |
2026-09-18 |
| elastic |
Potential Active Directory Replication Account Backdoor |
production |
2026-09-18 |
| elastic |
Creation or Modification of Domain Backup DPAPI private key |
production |
2026-09-18 |
| elastic |
Credential Acquisition via Registry Hive Dumping |
production |
2026-09-18 |
| elastic |
Full User-Mode Dumps Enabled System-Wide |
production |
2026-09-18 |
| elastic |
Microsoft IIS Service Account Password Dumped |
production |
2026-09-18 |
| elastic |
Microsoft IIS Connection Strings Decryption |
production |
2026-09-18 |
| elastic |
Untrusted DLL Loaded by Azure AD Connect Authentication Agent |
production |
2026-09-18 |
| elastic |
Kirbi File Creation |
production |
2026-09-18 |
| elastic |
Suspicious LSASS Access via MalSecLogon |
production |
2026-09-18 |
| elastic |
Suspicious Module Loaded by LSASS |
production |
2026-09-18 |
| elastic |
LSASS Memory Dump Creation |
production |
2026-09-18 |
| elastic |
LSASS Memory Dump Handle Access |
production |
2026-09-18 |
| elastic |
Mimikatz Memssp Log File Detected |
production |
2026-09-18 |
| elastic |
Potential Invoke-Mimikatz PowerShell Script |
production |
2026-09-18 |
| elastic |
Modification of WDigest Security Provider |
production |
2026-09-18 |
| elastic |
Windows Registry File Creation in SMB Share |
production |
2026-09-18 |
| elastic |
PowerShell Invoke-NinjaCopy script |
production |
2026-09-18 |
| elastic |
PowerShell Kerberos Ticket Dump |
production |
2026-09-18 |
| elastic |
PowerShell MiniDump Script |
production |
2026-09-18 |
| elastic |
PowerShell Script with Veeam Credential Access Capabilities |
production |
2026-09-18 |
| elastic |
Potential Credential Access via DuplicateHandle in LSASS |
production |
2026-09-18 |
| elastic |
Sensitive Registry Hive Access via RegBack |
production |
2026-09-18 |
| elastic |
Potential Remote Credential Access via Registry |
production |
2026-09-18 |
| elastic |
Multiple Vault Web Credentials Read |
production |
2026-09-18 |
| elastic |
Searching for Saved Credentials via VaultCmd |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Renamed COM+ Services DLL |
production |
2026-09-18 |
| elastic |
Potential Credential Access via LSASS Memory Dump |
production |
2026-09-18 |
| elastic |
Potential LSASS Memory Dump via PssCaptureSnapShot |
production |
2026-09-18 |
| elastic |
Suspicious Remote Registry Access via SeBackupPrivilege |
production |
2026-09-18 |
| elastic |
Veeam Backup Library Loaded by Unusual Process |
production |
2026-09-18 |
| elastic |
Potential Veeam Credential Access Command |
production |
2026-09-18 |
| elastic |
Potential LSASS Clone Creation via PssCaptureSnapShot |
production |
2026-09-18 |
| elastic |
NTDS Dump via Wbadmin |
production |
2026-09-18 |
| elastic |
Wireless Credential Dumping using Netsh Command |
production |
2026-09-18 |
| elastic |
Disabling Lsa Protection via Registry Modification |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Potential Secret Scanning via Gitleaks |
production |
2026-09-18 |
| elastic |
Credential Access via TruffleHog Execution |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| elastic |
Potential Linux Credential Dumping via Unshadow |
production |
2026-09-18 |
| elastic |
Linux init (PID 1) Secret Dump via GDB |
production |
2026-09-18 |
| elastic |
Linux Process Hooking via GDB |
production |
2026-09-18 |
| elastic |
Manual Memory Dumping via Proc Filesystem |
production |
2026-09-18 |
| splunk |
PowerShell 4104 Hunting |
production |
2026-09-03 |
| sigma |
Credential Manager Access By Uncommon Applications |
test |
2026-07-28 |
| sigma |
Registry Hive File Staged Outside Standard User Profile Path |
experimental |
2026-07-23 |
| splunk |
PetitPotam Suspicious Kerberos TGT Request |
production |
2026-07-04 |
| sigma |
Antivirus - Password Dumper Signature |
stable |
2026-06-15 |
| splunk |
Windows Remote Access Software BRC4 Loaded Dll |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High Priority Intrusion Classification |
production |
2026-05-13 |
| splunk |
Detect Mimikatz With PowerShell Script Block Logging |
production |
2026-05-13 |
| splunk |
Windows LAPS Password Gathering Via PowerShell Script |
production |
2026-05-13 |
| splunk |
Windows Mimikatz Binary Execution |
production |
2026-05-13 |
| splunk |
Windows Post Exploitation Risk Behavior |
production |
2026-05-13 |
| sigma |
Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 |
experimental |
2026-04-28 |
| sigma |
PUA - Memory Dump Mount Via MemProcFS |
experimental |
2026-04-27 |
| sigma |
Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location |
experimental |
2026-01-09 |
| sigma |
Capture Credentials with Rpcping.exe |
test |
2025-10-31 |
| sigma |
PUA - AWS TruffleHog Execution |
experimental |
2025-10-21 |
| sigma |
File Access Of Signal Desktop Sensitive Data |
experimental |
2025-10-19 |
| sigma |
Suspicious SYSTEM User Process Creation |
test |
2025-10-19 |
| sigma |
WCE wceaux.dll Access |
test |
2025-01-30 |
| sigma |
Hacktool Execution - Imphash |
test |
2024-11-23 |
| sigma |
Access To Crypto Currency Wallets By Uncommon Applications |
test |
2024-07-29 |
| sigma |
Access To Chromium Browsers Sensitive Files By Uncommon Applications |
test |
2024-07-29 |
| sigma |
Access To Browser Credential Files By Uncommon Applications |
test |
2024-07-29 |
| sigma |
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump |
test |
2024-06-27 |
| sigma |
Loaded Module Enumeration Via Tasklist.EXE |
test |
2024-03-13 |
| sigma |
OpenCanary - REDIS Action Command Attempt |
test |
2024-03-08 |
| sigma |
OpenCanary - MySQL Login Attempt |
test |
2024-03-08 |
| sigma |
OpenCanary - MSSQL Login Attempt Via Windows Authentication |
test |
2024-03-08 |
| sigma |
OpenCanary - MSSQL Login Attempt Via SQLAuth |
test |
2024-03-08 |
| sigma |
Interesting Service Enumeration Via Sc.EXE |
test |
2024-02-12 |
| sigma |
Hacktool Execution - PE Metadata |
test |
2024-01-15 |
| sigma |
Rare Subscription-level Operations In Azure |
test |
2023-10-11 |
| sigma |
Potentially Suspicious ODBC Driver Registered |
test |
2023-08-17 |
| sigma |
Potential Credential Dumping Attempt Using New NetworkProvider - REG |
test |
2023-08-17 |
| sigma |
HackTool - Rubeus Execution - ScriptBlock |
test |
2023-04-27 |
| sigma |
HackTool - Rubeus Execution |
stable |
2023-04-20 |
| sigma |
Potential Credential Dumping Via LSASS Process Clone |
test |
2023-03-02 |
| sigma |
Potential Credential Dumping Attempt Using New NetworkProvider - CLI |
test |
2023-02-02 |
| sigma |
Microsoft IIS Service Account Password Dumped |
test |
2023-01-22 |
| sigma |
Microsoft IIS Connection Strings Decryption |
test |
2022-12-30 |
| sigma |
Live Memory Dump Using Powershell |
test |
2022-12-25 |
| sigma |
Linux Keylogging with Pam.d |
test |
2022-12-18 |
| sigma |
Shadow Copies Creation Using Operating Systems Utilities |
test |
2022-11-10 |
| sigma |
Esentutl Gather Credentials |
test |
2022-10-09 |
| sigma |
Potential Invoke-Mimikatz PowerShell Script |
test |
2022-09-28 |
| suricata |
ET ATTACK_RESPONSE Windows 32bit procdump Dump File Exfiltration |
rev 2 |
2019-07-26 |
| suricata |
ET ATTACK_RESPONSE Windows 64bit procdump Dump File Exfiltration |
rev 2 |
2019-07-26 |
| snort |
ET ATTACK_RESPONSE Windows 64bit procdump Dump File Exfiltration |
rev 2 |
2019-06-05 |
| snort |
ET ATTACK_RESPONSE Windows 32bit procdump Dump File Exfiltration |
rev 2 |
2019-06-05 |
| sentinel |
Europium - Hash and IP IOCs - September 2022 |
Scheduled |
— |
| sentinel |
Dev-0228 File Path Hashes November 2021 |
Scheduled |
— |
| sentinel |
Dev-0228 File Path Hashes November 2021 (ASIM Version) |
Scheduled |
— |