Detects suspicious processes that write (copy) a Active Directory database (ntds.dit) file

Detects suspicious PowerShell scripts accessing SAM hives

Detects a dump file written by QuarksPwDump password dumper

Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.

Detects volume shadow copy mount

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Shadow Copies creation using operating systems utilities, possible credential access

Shadow Copies storage symbolic link creation using operating systems utilities

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through Windows Registry where the SAM database is stored

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through Windows Registry where the SAM database is stored

Detects QuarksPwDump clearing access history in hive

Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

Detect AD credential dumping using impacket secretdump HKTL

Detection well-known mimikatz command line arguments

Dump sam, system or security hives using REG.exe utility

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\System\CurrentControlSet\Services\VSS\Diag\VolSnap\Volume are captured.

Detects well-known credential dumping tools execution via service execution events

Detects well-known credential dumping tools execution via specific named pipes

Detects a highly relevant Antivirus alert that reports a password dumper