Update dump_lsass_via_comsvcs_dll.yml

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -5,7 +5,7 @@ date: '2023-04-14'
 author: Patrick Bareiss, Splunk
 status: production
 type: TTP
-description: 'The following analytic targets a tactic often used by adversaries to dump credentials from memory. The Local Security Authority Subsystem Service (LSASS) manages system-level authentication in Windows. Exploitation of this process, particularly through the use of the comsvcs.dll, allows threat actors to obtain valuable credentials. This analytic actively searches for instances where the rundll32 process is used in conjunction with the comsvcs.dll and MiniDump—indications of potential LSASS dumping attempts. This tactic is usually a part of more extensive attack campaigns and is associated with numerous threat groups. Understanding this analytics function and recognizing the gravity of LSASS exploitation is crucial for cybersecurity analysts, as credential theft can often lead to broader system compromise, persistence, lateral movement, and escalated privileges. It iss important to note that, to the best of current knowledge, no legitimate use of this technique has been identified.'
+description: 'The following analytic detects the behavior of dumping credentials from memory, a tactic commonly used by adversaries. Specifically, it targets the exploitation of the Local Security Authority Subsystem Service (LSASS) in Windows, which manages system-level authentication. Threat actors can use the comsvcs.dll to exploit this process and obtain valuable credentials. The analytic identifies instances where the rundll32 process is used in conjunction with the comsvcs.dll and MiniDump, indicating potential LSASS dumping attempts. This tactic is often part of more extensive attack campaigns and is associated with numerous threat groups. Identifying this behavior is crucial for security operations center (SOC) analysts, as credential theft can lead to broader system compromise, persistence, lateral movement, and escalated privileges. It is important to note that no legitimate use of this technique has been identified so far. The impact of the attack, if a true positive is found, can be severe. Attackers can use the stolen credentials to access sensitive information or systems, leading to data theft, ransomware attacks, or other damaging outcomes. To implement this analytic, ensure that logs with process information are ingested from your endpoints. However, be aware of potential false positives, as legitimate uses of the LSASS process may cause benign activities to be flagged. Upon triage, review the processes involved in the LSASS dumping attempt, capture and inspect any relevant on-disk artifacts, and look for concurrent processes to identify the attack source. By identifying and mitigating LSASS exploitation attempts early on, SOC analysts can better protect their organization''s assets and prevent potential breaches.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)