name: Credential Extraction native Microsoft debuggers via z command line option
id: adc51a77-90c9-4358-b43c-f10dd1a27d05
version: 1
date: '2020-10-18'
author: Stanislav Miskovic, Splunk
type: streaming
datamodel: []
description: Credential extraction is often an illegal recovery of credential material
  from secured authentication resources and repositories. This process may also involve
  decryption or other transformations of the stored credential material. Native Microsoft
  debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential
  material directly from memory and process dumps.
search: ' | from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
  "process_name"), "string", null) | where cmd_line != null AND process_name != null
  AND ( match_regex(process_name, /^(?i)ntkd\.exe/)=true OR match_regex(process_name,
  /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, /(?i)\-z\s+/)=true

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
  "string", null)), body = "TBD" | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
known_false_positives: Although unlikely, using debuggers this way may be indicative
  of developers analyzing crash dumps of their code. Note, even for developers this
  is an unusual way of working on code - debuggers are mostly used to step through
  code, not analyze its crash dumps.
references: []
tags:
  analytic_story:
  - Credential Dumping
  - Unusual Processes
  asset_type: Windows
  cis20:
  - CIS 16
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1003
  nist:
  - PR.AC
  - PR.IP
  product:
  - UEBA for Security Cloud
  required_fields:
  - process_name
  - _time
  - dest_device_id
  - dest_user_id
  - process
  risk_severity: medium
  security_domain: endpoint
