name: Access LSASS Memory for Dump Creation
id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717
version: 2
date: '2019-12-06'
author: Patrick Bareiss, Splunk
type: batch
datamodel: []
description: Detect memory dumping of the LSASS process.
search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll*
  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage,
  TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter` '
how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
  includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`.
  We strongly recommend that you specify your environment-specific configurations
  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
  with configurations for your Splunk environment. The search also uses a post-filter
  macro designed to filter out known false positives.
known_false_positives: Administrators can create memory dumps for debugging purposes,
  but memory dumps of the LSASS process would be unusual.
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
tags:
  analytic_story:
  - Credential Dumping
  asset_type: Windows
  automated_detection_testing: passed
  cis20:
  - CIS 6
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1003.001
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - TargetImage
  - CallTrace
  - Computer
  - TargetProcessId
  - SourceImage
  - SourceProcessId
  security_domain: endpoint
