test

detections/endpoint/access_lsass_memory_for_dump_creation_two.yml

@@ -0,0 +1,52 @@
+name: Access LSASS Memory for Dump Creation Two
+id: fb4c31b0-13e8-4155-8aa5-24de4b8d6718
+version: 2
+date: '2019-12-06'
+author: Patrick Bareiss, Splunk
+type: batch
+datamodel: []
+description: Detect memory dumping of the LSASS process.
+search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll*
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage,
+  TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter` '
+how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
+  includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`.
+  We strongly recommend that you specify your environment-specific configurations
+  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
+  with configurations for your Splunk environment. The search also uses a post-filter
+  macro designed to filter out known false positives.
+known_false_positives: Administrators can create memory dumps for debugging purposes,
+  but memory dumps of the LSASS process would be unusual.
+references:
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+tags:
+  analytic_story:
+  - Credential Dumping
+  asset_type: Windows
+  automated_detection_testing: passed
+  cis20:
+  - CIS 6
+  - CIS 8
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1003.001
+  nist:
+  - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetImage
+  - CallTrace
+  - Computer
+  - TargetProcessId
+  - SourceImage
+  - SourceProcessId
+  security_domain: endpoint

detections/endpoint/bitsadmin_download_file.yml

@@ -59,3 +59,4 @@ tags:
   - Processes.user
   - Processes.dest
   security_domain: endpoint
+

tests/endpoint/access_lsass_memory_for_dump_creation_two.test.yml

@@ -0,0 +1,12 @@
+name: Access LSASS Memory for Dump Creation Two Unit Test
+tests:
+- name: Access LSASS Memory for Dump Creation Two
+  file: endpoint/access_lsass_memory_for_dump_creation_two.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog