From 83a7679ca9d09eaa4ace3edbd4aa9083cbdbe77b Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareib@splunk.com>
Date: Wed, 9 Jun 2021 12:54:02 +0200
Subject: [PATCH] test

---
 ...ess_lsass_memory_for_dump_creation_two.yml | 52 +++++++++++++++++++
 .../endpoint/bitsadmin_download_file.yml      |  1 +
 ...sass_memory_for_dump_creation_two.test.yml | 12 +++++
 3 files changed, 65 insertions(+)
 create mode 100644 detections/endpoint/access_lsass_memory_for_dump_creation_two.yml
 create mode 100644 tests/endpoint/access_lsass_memory_for_dump_creation_two.test.yml

diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation_two.yml b/detections/endpoint/access_lsass_memory_for_dump_creation_two.yml
new file mode 100644
index 0000000000..647f1d6f12
--- /dev/null
+++ b/detections/endpoint/access_lsass_memory_for_dump_creation_two.yml
@@ -0,0 +1,52 @@
+name: Access LSASS Memory for Dump Creation Two
+id: fb4c31b0-13e8-4155-8aa5-24de4b8d6718
+version: 2
+date: '2019-12-06'
+author: Patrick Bareiss, Splunk
+type: batch
+datamodel: []
+description: Detect memory dumping of the LSASS process.
+search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll*
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage,
+  TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter` '
+how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
+  includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`.
+  We strongly recommend that you specify your environment-specific configurations
+  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
+  with configurations for your Splunk environment. The search also uses a post-filter
+  macro designed to filter out known false positives.
+known_false_positives: Administrators can create memory dumps for debugging purposes,
+  but memory dumps of the LSASS process would be unusual.
+references:
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+tags:
+  analytic_story:
+  - Credential Dumping
+  asset_type: Windows
+  automated_detection_testing: passed
+  cis20:
+  - CIS 6
+  - CIS 8
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1003.001
+  nist:
+  - DE.CM
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - TargetImage
+  - CallTrace
+  - Computer
+  - TargetProcessId
+  - SourceImage
+  - SourceProcessId
+  security_domain: endpoint
diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml
index e63975b329..e59e15cfa2 100644
--- a/detections/endpoint/bitsadmin_download_file.yml
+++ b/detections/endpoint/bitsadmin_download_file.yml
@@ -59,3 +59,4 @@ tags:
   - Processes.user
   - Processes.dest
   security_domain: endpoint
+
diff --git a/tests/endpoint/access_lsass_memory_for_dump_creation_two.test.yml b/tests/endpoint/access_lsass_memory_for_dump_creation_two.test.yml
new file mode 100644
index 0000000000..f887f30012
--- /dev/null
+++ b/tests/endpoint/access_lsass_memory_for_dump_creation_two.test.yml
@@ -0,0 +1,12 @@
+name: Access LSASS Memory for Dump Creation Two Unit Test
+tests:
+- name: Access LSASS Memory for Dump Creation Two
+  file: endpoint/access_lsass_memory_for_dump_creation_two.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog