name: Create Remote Thread into LSASS
id: 67d4dbef-9564-4699-8da8-03a151529edc
version: 1
date: '2019-12-06'
description: Detect remote thread creation into LSASS consistent with credential dumping.
how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which
  includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`.
  We strongly recommend that you specify your environment-specific configurations
  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
  with configurations for your Splunk environment. The search also uses a post-filter
  macro designed to filter out known false positives.
type: ESCU
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
author: Patrick Bareiss, Splunk
search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime
  max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId | rename
  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `create_remote_thread_into_lsass_filter`'
known_false_positives: Other tools can access LSASS for legitimate reasons and generate
  an event. In these cases, tweaking the search may help eliminate noise.
tags:
  analytics_story:
  - Credential Dumping
  mitre_attack_id:
  - T1003.001
  kill_chain_phases:
  - Actions on Objectives
  cis20:
  - CIS 8
  - CIS 16
  nist:
  - DE.CM
  security_domain: endpoint
  asset_type: Windows