MITRE ATT&CK T1003 Detection Rules | Fibratus

Reglas de detección de Fibratus mapeadas a la técnica T1003 de MITRE ATT&CK. Cobertura basada en comportamiento a nivel de kernel.

Volver a todas las reglas

Reglas en esta categoría

• File access to SAM database
• Credential Manager access via known tools
• LSASS access from unsigned executable
• LSASS handle leak via Seclogon
• LSASS memory dump preparation via SilentProcessExit
• LSASS memory dump via MiniDumpWriteDump
• LSASS memory dump via Windows Error Reporting
• LSASS process clone creation via reflection
• Potential LSASS memory dump
• Registry access to SAM database
• Remote thread creation into LSASS
• Sensitive registry hive dump
• Suspicious access to Active Directory domain database
• Suspicious LSA secrets registry access
• Suspicious LSASS process access
• Suspicious security package DLL loaded