Branch was auto-updated.

detections/endpoint/windows_possible_credential_dumping.yml

@@ -1,7 +1,7 @@
 name: Windows Possible Credential Dumping
 id: e4723b92-7266-11ec-af45-acde48001122
-version: 1
-date: '2022-01-10'
+version: 2
+date: '2022-01-27'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -24,7 +24,7 @@ description: 'The following analytic is an enhanced version of two previous anal
   For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory,
   used to execute this module which is related to lsass dumping.'
 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000",
-  "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x1438", "0x143a",
+  "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a",
   "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*")
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage,
   GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer
@@ -34,8 +34,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
-known_false_positives: False positives will occur based on GrantedAccess, filter based
-  on source image as needed.
+known_false_positives: False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based
+  on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught.
 references:
 - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
 - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump