From b9f14495487cfea8d671457bfed72ea799cadfca Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 13 Jan 2022 09:18:12 -0700
Subject: [PATCH] Updates

---
 ...hunting_system_account_targeting_lsass.yml | 84 +++++++++++++++++++
 ...ows_non_system_account_targeting_lsass.yml | 81 ++++++++++++++++++
 .../windows_possible_credential_dumping.yml   | 10 ++-
 ...ng_system_account_targeting_lsass.test.yml | 12 +++
 ...on_system_account_targeting_lsass.test.yml | 12 +++
 5 files changed, 195 insertions(+), 4 deletions(-)
 create mode 100644 detections/endpoint/windows_hunting_system_account_targeting_lsass.yml
 create mode 100644 detections/endpoint/windows_non_system_account_targeting_lsass.yml
 create mode 100644 tests/endpoint/windows_hunting_system_account_targeting_lsass.test.yml
 create mode 100644 tests/endpoint/windows_non_system_account_targeting_lsass.test.yml

diff --git a/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml
new file mode 100644
index 0000000000..1596a242ea
--- /dev/null
+++ b/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml
@@ -0,0 +1,84 @@
+name: Windows Hunting System Account Targeting Lsass
+id: 1c6abb08-73d1-11ec-9ca0-acde48001122
+version: 1
+date: '2022-01-12'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: The following hunting analytic identifies all processes requesting access into Lsass.exe. his behavior may be related to credential dumping or applications requiring access to credentials. 
+  Triaging this event will require understanding the GrantedAccess from the SourceImage. In addition, whether the account is privileged or not. Review the process requesting permissions and review parallel processes.
+search: '`sysmon` EventCode=10 TargetImage=*lsass.exe 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser 
+  | rename Computer as dest 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_hunting_system_account_targeting_lsass_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
+known_false_positives: False positives will occur based on GrantedAccess and SourceUser, filter based on source image as needed.
+references:
+  - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
+  - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
+  - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
+  - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
+  - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN
+tags:
+  analytic_story:
+  - Credential Dumping
+  dataset: []
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related
+    to credential dumping on $dest$. Review for further details.
+  mitre_attack_id:
+  - T1003.001
+  - T1003
+  nist:
+  - DE.AE
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: ImageLoaded
+    type: Parent Process
+    role:
+    - Other
+  - name: SourceImage
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - TargetImage
+  - GrantedAccess
+  - SourceImage
+  - SourceProcessId
+  - SourceUser
+  - TargetUser
+  risk_score: 64
+  security_domain: endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log
+  automated_detection_testing: passed
\ No newline at end of file
diff --git a/detections/endpoint/windows_non_system_account_targeting_lsass.yml b/detections/endpoint/windows_non_system_account_targeting_lsass.yml
new file mode 100644
index 0000000000..46b2b9619f
--- /dev/null
+++ b/detections/endpoint/windows_non_system_account_targeting_lsass.yml
@@ -0,0 +1,81 @@
+name: Windows Non-System Account Targeting Lsass
+id: b1ce9a72-73cf-11ec-981b-acde48001122
+version: 1
+date: '2022-01-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies non SYSTEM accounts requesting access to lsass.exe. This behavior may be related to credential dumping or applications requiring access to credentials. 
+  Triaging this event will require understanding the GrantedAccess from the SourceImage. In addition, whether the account is privileged or not. Review the process requesting permissions and review parallel processes.
+search: '`sysmon` EventCode=10 TargetImage=*lsass.exe SourceUser!="NT AUTHORITY\\*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `windows_non_system_account_targeting_lsass_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
+known_false_positives: False positives will occur based on legitimate application requests, filter based on source image as needed.
+references:
+  - https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
+  - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
+  - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
+  - https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
+  - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN
+tags:
+  analytic_story:
+  - Credential Dumping
+  dataset: []
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related
+    to credential dumping on $dest$. Review for further details.
+  mitre_attack_id:
+  - T1003.001
+  - T1003
+  nist:
+  - DE.AE
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: ImageLoaded
+    type: Parent Process
+    role:
+    - Other
+  - name: SourceImage
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Computer
+  - TargetImage
+  - GrantedAccess
+  - SourceImage
+  - SourceProcessId
+  - SourceUser
+  - TargetUser
+  risk_score: 64
+  security_domain: endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log
+  automated_detection_testing: passed
\ No newline at end of file
diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml
index 788e304c0e..02b2f3fa04 100644
--- a/detections/endpoint/windows_possible_credential_dumping.yml
+++ b/detections/endpoint/windows_possible_credential_dumping.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2022-01-10'
 author: Michael Haag, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following analytic is an enhanced version of two previous analytics that identifies common GrantedAccess permission requests and CallTrace DLLs in order to detect credential dumping. \
 
   GrantedAccess is the requested permissions by the SourceImage into the TargetImage. \
@@ -46,7 +45,7 @@ tags:
   impact: 80
   kill_chain_phases:
   - Actions on Objectives
-  message: A process, $Image$, has loaded $ImageLoaded$ that are typically related
+  message: A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related
     to credential dumping on $dest$. Review for further details.
   mitre_attack_id:
   - T1003.001
@@ -67,7 +66,7 @@ tags:
     type: Parent Process
     role:
     - Other
-  - name: Image
+  - name: SourceImage
     type: Process
     role:
     - Child Process
@@ -86,3 +85,6 @@ tags:
   - TargetUser
   risk_score: 64
   security_domain: endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log
+  automated_detection_testing: passed
\ No newline at end of file
diff --git a/tests/endpoint/windows_hunting_system_account_targeting_lsass.test.yml b/tests/endpoint/windows_hunting_system_account_targeting_lsass.test.yml
new file mode 100644
index 0000000000..cadd15ad3c
--- /dev/null
+++ b/tests/endpoint/windows_hunting_system_account_targeting_lsass.test.yml
@@ -0,0 +1,12 @@
+name: Windows Hunting System Account Targeting Lsass Unit Test
+tests:
+- name: Windows Hunting System Account Targeting Lsass
+  file: endpoint/windows_hunting_system_account_targeting_lsass.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/windows_non_system_account_targeting_lsass.test.yml b/tests/endpoint/windows_non_system_account_targeting_lsass.test.yml
new file mode 100644
index 0000000000..2afe0fc76c
--- /dev/null
+++ b/tests/endpoint/windows_non_system_account_targeting_lsass.test.yml
@@ -0,0 +1,12 @@
+name: Windows Non-System Account Targeting Lsass Unit Test
+tests:
+- name: Windows Non-System Account Targeting Lsass
+  file: endpoint/windows_non_system_account_targeting_lsass.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file