MITRE ATT&CK T1003 Detection Rules | Fibratus

Fibratus detection rules mapped to MITRE ATT&CK technique T1003. Kernel-level, behavior-driven detection coverage.

Back to all rules

Rules in this category

• File access to SAM database
• Credential Manager access via known tools
• LSASS access from unsigned executable
• LSASS handle leak via Seclogon
• LSASS memory dump preparation via SilentProcessExit
• LSASS memory dump via MiniDumpWriteDump
• LSASS memory dump via Windows Error Reporting
• LSASS process clone creation via reflection
• Potential LSASS memory dump
• Registry access to SAM database
• Remote thread creation into LSASS
• Sensitive registry hive dump
• Suspicious access to Active Directory domain database
• Suspicious LSA secrets registry access
• Suspicious LSASS process access
• Suspicious security package DLL loaded