name: Credential Extraction indicative of FGDump and CacheDump with s option
id: 312582f2-5e91-42c1-a275-cd67f31373c8
version: 1
date: '2020-10-18'
author: Stanislav Miskovic, Splunk
type: streaming
datamodel: []
description: Credential extraction is often an illegal recovery of credential material
  from secured authentication resources and repositories. This process may also involve
  decryption or other transformations of the stored credential material. FGdump is
  a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
  Windows. Cachedump is a publicly-available tool that extracts cached password hashes
  from a system's registry.
search: ' | from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
  "string", null) | where cmd_line != null AND process_name != null AND parent_process_name
  != null AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true
  AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path,
  /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-s/)=true

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
  "string", null)), body = "TBD" | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
references: []
tags:
  analytic_story:
  - Unusual Processes
  - Credential Dumping
  asset_type: Windows
  cis20:
  - CIS 16
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1003
  nist:
  - PR.AC
  - PR.IP
  product:
  - UEBA for Security Cloud
  required_fields:
  - dest_device_id
  - process_name
  - parent_process_name
  - _time
  - process_path
  - dest_user_id
  - process
  risk_severity: high
  security_domain: endpoint
