name: Creation of lsass Dump with Taskmgr
id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
version: 1
date: '2020-02-03'
author: Michael Haag, Splunk
type: batch
datamodel: []
description: Detect the hands on keyboard behavior of Windows Task Manager creating
  a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification
  will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp,
  cannot be renamed, however if the dump occurs more than once, it will be named lsass
  (2).dmp.
search: '`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp |
  stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category,
  process_name, TargetFilename | rename Computer as dest | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `creation_of_lsass_dump_with_taskmgr_filter`'
how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
  includes EventCode 11 for detecting file create of lsass.dmp. This search uses an
  input macro named `sysmon`. We strongly recommend that you specify your environment-specific
  configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace
  the macro definition with configurations for your Splunk environment. The search
  also uses a post-filter macro designed to filter out known false positives.
known_false_positives: Administrators can create memory dumps for debugging purposes,
  but memory dumps of the LSASS process would be unusual.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager
- https://attack.mitre.org/techniques/T1003/001/
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
tags:
  analytic_story:
  - Credential Dumping
  asset_type: Windows
  automated_detection_testing: passed
  cis20:
  - CIS 6
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1003.001
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventID
  - process_name
  - TargetFilename
  - Computer
  - object_category
  security_domain: endpoint
