| splunk |
Windows Sensitive Registry Hive Dump Via CommandLine |
production |
2026-10-02 |
| splunk |
Esentutl SAM Copy |
production |
2026-10-02 |
| elastic |
Symbolic Link to Shadow Copy Created |
production |
2026-09-18 |
| elastic |
Suspicious Remote Registry Access via SeBackupPrivilege |
production |
2026-09-18 |
| elastic |
Potential Remote Credential Access via Registry |
production |
2026-09-18 |
| elastic |
Sensitive Registry Hive Access via RegBack |
production |
2026-09-18 |
| elastic |
PowerShell Invoke-NinjaCopy script |
production |
2026-09-18 |
| elastic |
Windows Registry File Creation in SMB Share |
production |
2026-09-18 |
| elastic |
Potential Invoke-Mimikatz PowerShell Script |
production |
2026-09-18 |
| elastic |
Credential Acquisition via Registry Hive Dumping |
production |
2026-09-18 |
| elastic |
NTDS or SAM Database File Copied |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Trusted Developer Utility |
production |
2026-09-18 |
| elastic |
NTDS Dump via Wbadmin |
production |
2026-09-18 |
| sigma |
Antivirus - Password Dumper Signature |
stable |
2026-06-15 |
| splunk |
Windows Rapid Authentication On Multiple Hosts |
production |
2026-05-13 |
| splunk |
SAM Database File Access Attempt |
production |
2026-05-13 |
| splunk |
Detect Copy of ShadowCopy with Script Block Logging |
production |
2026-05-13 |
| splunk |
O365 Privileged Graph API Permission Assigned |
production |
2026-05-13 |
| splunk |
Azure AD Privileged Graph API Permission Assigned |
production |
2026-05-13 |
| splunk |
Azure AD Privileged Authentication Administrator Role Assigned |
production |
2026-05-13 |
| sigma |
Sensitive File Dump Via Print.EXE |
test |
2026-04-28 |
| sigma |
PUA - Memory Dump Mount Via MemProcFS |
experimental |
2026-04-27 |
| sigma |
Cred Dump Tools Dropped Files |
test |
2025-10-25 |
| sigma |
Transferring Files with Credential Data via Network Shares |
test |
2025-07-11 |
| sigma |
Crash Dump Created By Operating System |
experimental |
2025-05-12 |
| sigma |
HackTool - QuarksPwDump Dump File |
test |
2024-06-27 |
| sigma |
Copying Sensitive Files with Credential Data |
test |
2024-06-04 |
| sigma |
Critical Hive In Suspicious Location Access Bits Cleared |
test |
2024-01-18 |
| sigma |
Dumping of Sensitive Hives Via Reg.EXE |
test |
2023-12-13 |
| sigma |
HackTool - Credential Dumping Tools Named Pipe Created |
test |
2023-08-07 |
| sigma |
VolumeShadowCopy Symlink Creation Via Mklink |
stable |
2023-03-06 |
| sigma |
HackTool - Mimikatz Execution |
test |
2023-02-21 |
| sigma |
HackTool - Quarks PwDump Execution |
test |
2023-02-05 |
| sigma |
HackTool - Pypykatz Credentials Dumping Activity |
test |
2023-02-05 |
| sigma |
PowerShell SAM Copy |
test |
2023-01-06 |
| sigma |
Potential SAM Database Dump |
test |
2023-01-05 |
| sigma |
Esentutl Volume Shadow Copy Service Keys |
test |
2022-12-25 |
| sigma |
Volume Shadow Copy Mount |
test |
2022-12-25 |
| sigma |
Credential Dumping Tools Service Execution - Security |
test |
2022-11-29 |
| sigma |
Credential Dumping Tools Service Execution - System |
test |
2022-11-29 |
| sigma |
Shadow Copies Creation Using Operating Systems Utilities |
test |
2022-11-10 |
| sigma |
Possible Impacket SecretDump Remote Activity |
test |
2022-08-11 |
| sigma |
NTDS.DIT Creation By Uncommon Process |
test |
2022-07-14 |
| sigma |
VSSAudit Security Event Source Registration |
test |
2022-04-28 |
| sigma |
Mimikatz Use |
test |
2022-01-05 |
| sigma |
Transferring Files with Credential Data via Network Shares - Zeek |
test |
2021-11-27 |
| sigma |
Possible Impacket SecretDump Remote Activity - Zeek |
test |
2021-11-27 |