| elastic |
Credential Acquisition via Registry Hive Dumping |
production |
2026-09-18 |
| elastic |
Suspicious Remote Registry Access via SeBackupPrivilege |
production |
2026-09-18 |
| elastic |
Sensitive Registry Hive Access via RegBack |
production |
2026-09-18 |
| elastic |
PowerShell Invoke-NinjaCopy script |
production |
2026-09-18 |
| elastic |
Potential Invoke-Mimikatz PowerShell Script |
production |
2026-09-18 |
| splunk |
Windows LSA Secrets NoLMhash Registry |
production |
2026-05-13 |
| sigma |
PUA - Memory Dump Mount Via MemProcFS |
experimental |
2026-04-27 |
| sigma |
Cred Dump Tools Dropped Files |
test |
2025-10-25 |
| sigma |
Dumping of Sensitive Hives Via Reg.EXE |
test |
2023-12-13 |
| sigma |
HackTool - Credential Dumping Tools Named Pipe Created |
test |
2023-08-07 |
| sigma |
DPAPI Domain Master Key Backup Attempt |
test |
2023-03-15 |
| sigma |
HackTool - Mimikatz Execution |
test |
2023-02-21 |
| sigma |
Credential Dumping Tools Service Execution - System |
test |
2022-11-29 |
| sigma |
Credential Dumping Tools Service Execution - Security |
test |
2022-11-29 |
| sigma |
Possible Impacket SecretDump Remote Activity |
test |
2022-08-11 |
| sigma |
DPAPI Domain Backup Key Extraction |
test |
2022-02-24 |
| sigma |
Mimikatz Use |
test |
2022-01-05 |
| sigma |
Possible Impacket SecretDump Remote Activity - Zeek |
test |
2021-11-27 |