From ae7a648e7253fef5afb6c19b9d336feeee12d5a0 Mon Sep 17 00:00:00 2001
From: root <root@aa5b74247ade>
Date: Wed, 9 Sep 2020 12:25:00 +0000
Subject: [PATCH] Added detection testing service results inAccess LSASS Memory
 for Dump Creation

---
 .../access_lsass_memory_for_dump_creation.yml | 25 ++++++++++---------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/detections/access_lsass_memory_for_dump_creation.yml b/detections/access_lsass_memory_for_dump_creation.yml
index d1753d4c50..c3be56cd49 100644
--- a/detections/access_lsass_memory_for_dump_creation.yml
+++ b/detections/access_lsass_memory_for_dump_creation.yml
@@ -1,6 +1,4 @@
-name: Access LSASS Memory for Dump Creation
-id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717
-version: 2
+author: Patrick Bareiss, Splunk
 date: '2019-12-06'
 description: Detect memory dumping of the LSASS process.
 how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
@@ -9,27 +7,30 @@ how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, w
   (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
   with configurations for your Splunk environment. The search also uses a post-filter
   macro designed to filter out known false positives.
-type: ESCU
+id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717
+known_false_positives: Administrators can create memory dumps for debugging purposes,
+  but memory dumps of the LSASS process would be unusual.
+name: Access LSASS Memory for Dump Creation
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
-author: Patrick Bareiss, Splunk
 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll*
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage,
   TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter` '
-known_false_positives: Administrators can create memory dumps for debugging purposes,
-  but memory dumps of the LSASS process would be unusual.
 tags:
   analytics_story:
   - Credential Dumping
-  mitre_attack_id:
-  - T1003.001
-  kill_chain_phases:
-  - Actions on Objectives
+  asset_type: Windows
+  automated_detection_testing: passed
   cis20:
   - CIS 6
   - CIS 8
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1003.001
   nist:
   - DE.CM
   security_domain: endpoint
-  asset_type: Windows
+type: ESCU
+version: 2