Creation of lsass dump with taskmgr

detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml

@@ -0,0 +1,42 @@
+name: Creation of lsass Dump with Taskmgr
+id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
+version: 1
+date: '2020-02-03'
+description: Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe.
+  Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. 
+  The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. 
+how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
+  includes EventCode 11 for detecting file create of lsass.dmp. 
+  This search uses an input macro named `sysmon`.
+  We strongly recommend that you specify your environment-specific configurations
+  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
+  with configurations for your Splunk environment. The search also uses a post-filter
+  macro designed to filter out known false positives.
+type: ESCU
+references:
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=11 process_name=taskmgr.exe TargetFilename=*lsass*.dmp
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, object_category, process_name, TargetFilename
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `creation_of_lsass_dump_with_taskmgr_filter`'
+known_false_positives: Administrators can create memory dumps for debugging purposes,
+  but memory dumps of the LSASS process would be unusual.
+tags:
+  analytics_story:
+  - Credential Dumping
+  mitre_attack_id:
+  - T1003.001
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 6
+  - CIS 8
+  nist:
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Windows
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log

tests/endpoint/creation_of_lsass_dump_with_taskmgr.test.yml

@@ -0,0 +1,12 @@
+name: Creation of lsass dump with taskmgr Unit Test
+tests:
+- name: Creation of lsass dump with taskmgr
+  file: endpoint/creation_of_lsass_dump_with_taskmgr.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog