name: Create Remote Thread into LSASS
id: 67d4dbef-9564-4699-8da8-03a151529edc
version: 1
date: '2019-12-06'
author: Patrick Bareiss, Splunk
type: TTP
datamodel: []
description: Detect remote thread creation into LSASS consistent with credential dumping.
search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime
  max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId | rename
  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `create_remote_thread_into_lsass_filter`'
how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which
  includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`.
  We strongly recommend that you specify your environment-specific configurations
  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
  with configurations for your Splunk environment. The search also uses a post-filter
  macro designed to filter out known false positives.
known_false_positives: Other tools can access LSASS for legitimate reasons and generate
  an event. In these cases, tweaking the search may help eliminate noise.
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
tags:
  analytic_story:
  - Credential Dumping
  asset_type: Windows
  cis20:
  - CIS 8
  - CIS 16
  confidence: 90
  context:
  - Source:Endpoint
  - Stage:Credential Access
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
  impact: 90
  kill_chain_phases:
  - Actions on Objectives
  message: A process has created a remote thread into $TargetImage$ on $dest$. This
    behavior is indicative of credential dumping and should be investigated.
  mitre_attack_id:
  - T1003.001
  - T1003
  nist:
  - DE.CM
  observable:
  - name: TargetImage
    type: Other
    role:
    - Other
  - name: dest
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventID
  - TargetImage
  - Computer
  - EventCode
  - TargetImage
  - TargetProcessId
  - dest
  risk_score: 81
  security_domain: endpoint