From fafcb10ccff8f756fb36cbceb08330245c03e703 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 10 Sep 2020 21:28:45 +0000 Subject: [PATCH] Added detection testing service results inCreate Remote Thread into LSASS --- .../create_remote_thread_into_lsass.yml | 25 ++++++++++--------- 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/detections/create_remote_thread_into_lsass.yml b/detections/create_remote_thread_into_lsass.yml index a39a187aad..2c8056d3d9 100644 --- a/detections/create_remote_thread_into_lsass.yml +++ b/detections/create_remote_thread_into_lsass.yml @@ -1,6 +1,4 @@ -name: Create Remote Thread into LSASS -id: 67d4dbef-9564-4699-8da8-03a151529edc -version: 1 +author: Patrick Bareiss, Splunk date: '2019-12-06' description: Detect remote thread creation into LSASS consistent with credential dumping. how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which @@ -9,27 +7,30 @@ how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, whi (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -type: ESCU +id: 67d4dbef-9564-4699-8da8-03a151529edc +known_false_positives: Other tools can access LSASS for legitimate reasons and generate + an event. In these cases, tweaking the search may help eliminate noise. +name: Create Remote Thread into LSASS references: - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf -author: Patrick Bareiss, Splunk search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `create_remote_thread_into_lsass_filter`' -known_false_positives: Other tools can access LSASS for legitimate reasons and generate - an event. In these cases, tweaking the search may help eliminate noise. tags: analytics_story: - Credential Dumping - mitre_attack_id: - - T1003.001 - kill_chain_phases: - - Actions on Objectives + asset_type: Windows + automated_detection_testing: passed cis20: - CIS 8 - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1003.001 nist: - DE.CM security_domain: endpoint - asset_type: Windows +type: ESCU +version: 1