From 7d9e146f76692fa6788977cf3e5fb3cb45307a00 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 27 Jan 2022 13:17:30 -0700
Subject: [PATCH] Cred Dump Update

Based on feedback, updating analytic.
---
 .../endpoint/windows_possible_credential_dumping.yml   | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml
index 8e1a6810d5..198b71ca45 100644
--- a/detections/endpoint/windows_possible_credential_dumping.yml
+++ b/detections/endpoint/windows_possible_credential_dumping.yml
@@ -1,7 +1,7 @@
 name: Windows Possible Credential Dumping
 id: e4723b92-7266-11ec-af45-acde48001122
-version: 1
-date: '2022-01-10'
+version: 2
+date: '2022-01-27'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -24,7 +24,7 @@ description: 'The following analytic is an enhanced version of two previous anal
   For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory,
   used to execute this module which is related to lsass dumping.'
 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000",
-  "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x1438", "0x143a",
+  "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a",
   "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*")
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage,
   GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer
@@ -34,8 +34,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
-known_false_positives: False positives will occur based on GrantedAccess, filter based
-  on source image as needed.
+known_false_positives: False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based
+  on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught.
 references:
 - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
 - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump