name: Credential Extraction indicative of Lazagne command line options
id: 341975fa-4ad0-4f01-9acc-df4f69742db7
version: 1
date: '2020-10-18'
author: Stanislav Miskovic, Splunk
type: streaming
datamodel: []
description: Credential extraction is often an illegal recovery of credential material
  from secured authentication resources and repositories. This process may also involve
  decryption or other transformations of the stored credential material. LaZagne is
  a tool that extracts various kinds of credentials from a local computer, including
  account passwords, domain passwords, browser passwords, etc.
search: ' | from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
  != null AND match_regex(cmd_line, /(?i)all\s+\-oA\s+\-output/)=true

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
  "string", null)), body = "TBD" | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
references: []
tags:
  analytic_story:
  - Credential Dumping
  asset_type: Windows
  cis20:
  - CIS 16
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1003
  - T1555
  nist:
  - PR.IP
  - PR.AC
  product:
  - UEBA for Security Cloud
  required_fields:
  - dest_device_id
  - dest_user_id
  - process
  - _time
  risk_severity: high
  security_domain: endpoint
