name: Detect Dump LSASS Memory using comsvcs
id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
version: 1
date: '2020-09-15'
author: Jose Hernandez, Splunk
type: streaming
datamodel: []
description: This search detects the memory of lsass.exe being dumped for offline
  credential theft attack.
search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
  "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
  "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
  "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) |
  where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
  | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine),
  body = "TBD" | into write_ssa_detected_events();'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
  including Windows command line logging. You can see how we test this with [Event
  Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
  on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
known_false_positives: None identified.
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
tags:
  analytic_story:
  - Credential Dumping
  asset_type: Endpoint
  cis20:
  - CIS 8
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1003.003
  nist:
  - DE.CM
  product:
  - UEBA for Security Cloud
  required_fields:
  - process_name
  - _tenant
  - _time
  - dest_device_id
  - process
  risk_severity: low
  security_domain: endpoint
