- Правило An_attempt_was_made_to_lsass_process
- Правило Chrome_firefox_opera_cred_read
- Правило Credentials_MiniDumpWriteDump_Lsass
- Правило DCSync
- Правило Dump_lsass_via_process_access:
- Правило KeePass_CredDump
- Правило Keepass_Key_Dump_Via_KeeThief
- Правило Kerberos_pwd_spraying
- Правило LSASS_ProcDump
- Правило Mimikatz
- Правило Mimikatz_Memssp_Default_Log_Detected
- Правило PPL_Bypass_via_PPLDump_Tool
- Правило Phishing_windows_credentials_powershell_scriptblock
- Правило Remote_registry_access
- Change_powershell_policy_registry
- Clearing_eventlog
- DCShadow_Attack
- Detect_Fake_ComputerAccount
- Detect_hiding_files_via_attrib_cmdlet
- Detect_lolbin_pcalua_exec
- ImageLoad_from_Network_Share_to_LSASS
- Правило ParentPid_Spoofing
- Правило Portproxy_netsh
- Правило RDP_settings_tampering
- Правило ReverseShell_created_via_PEInjection
- Правило Subrule_ParentPid_Spoofing
- Правило Suspend_prpcess
- Правило Suspicious_Explorer_Injection
- Правило Detect_execution_imageload_wuauclt_lolbas
- Правило Schtasks_Commandline
- Правило Start_process_as_vshadow_child
- Правило VSSVC_service_state_changed
- Правило XP_Cmdshell_Usage
- Правило Change_wmi_subscription
- Правило Create_hidden_local_account
- Правило Create_persist_via_Hidden_Run_key_value
- Правило Create_persist_via_WinlogonShell
- Правило DCSync_prepare_Add_replicatation_rights_to_Account
- Правило DSRM_Password_Changed
- Правило Use_persist_Start_process_via_WinlogonShell
- Правило XP_Cmdshell_Enable
- Правило CreateProcessAsUser_Impersonation
- Правило Detect_Pass_the_Hash_via_Mimikatz_local
- Правило Named_Pipe_Impersonation_PrivEsc
- Правило Potential_Privileged_Escalation_via_KrbRelayUp
- Правило SeDebugPrivilege_Enabled
- Правило UACME_23_DismCore_Hijacking
- Правило UAC_Bypass_Via_Consent
- Правило Unquoted_Service_Path_Abuse
- Правило sAMAccountName_Spoofing