name: Detect Credential Dumping through LSASS access
id: 2c365e57-4414-4540-8dc0-73ab10729996
version: 3
date: '2019-12-03'
author: Patrick Bareiss, Splunk
type: batch
datamodel: []
description: This search looks for reading lsass memory consistent with credential
  dumping.
search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410)
  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage,
  SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename
  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `detect_credential_dumping_through_lsass_access_filter` '
how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
  includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`.
  We strongly recommend that you specify your environment-specific configurations
  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
  with configurations for your Splunk environment. The search also uses a post-filter
  macro designed to filter out known false positives.
known_false_positives: The activity may be legitimate. Other tools can access lsass
  for legitimate reasons, and it's possible this event could be generated in those
  cases. In these cases, false positives should be fairly obvious and you may need
  to tweak the search to eliminate noise.
references: []
tags:
  analytic_story:
  - Credential Dumping
  - Detect Zerologon Attack
  asset_type: Windows
  automated_detection_testing: passed
  cis20:
  - CIS 3
  - CIS 5
  - CIS 16
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1003.001
  nist:
  - PR.IP
  - PR.AC
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - TargetImage
  - GrantedAccess
  - Computer
  - SourceImage
  - SourceProcessId
  - TargetImage
  - TargetProcessId
  security_domain: endpoint
