mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
54 lines
3.0 KiB
JSON
54 lines
3.0 KiB
JSON
{
|
|
"category": "Adversary Tactics",
|
|
"channel": "ESCU",
|
|
"creation_date": "2018-08-08",
|
|
"description": "Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attmpts to dump credentials.",
|
|
"id": "854d78bf-d0e2-4f4e-b05c-640905f86d7a",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"modification_date": "2018-08-08",
|
|
"name": "Credential Dumping",
|
|
"narrative": "Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.<br></br>Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.<br></br>The detection searches in this Analytic Story monitor for the process <b>reg.exe</b> with the \"save\" parameter, as well as for a target registry path that specifies a binary export of credentials from the registry. In addition, the analytics flag Windows events and activities associated with the use of Mimikatz functionality in Powershell Empire.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "rvaldez@splunk.com",
|
|
"name": "Rico Valdez"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://attack.mitre.org/wiki/Technique/T1003",
|
|
"https://www.powershellempire.com/?page_id=112",
|
|
"https://4iq.com/4iq-discovers-1-4-billion-clear-text-credentials-single-database/"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Notable Info",
|
|
"Get Notable History",
|
|
"Get User Information from Identity Table",
|
|
"Get Authentication Logs For Endpoint",
|
|
"Get Risk Modifiers For User",
|
|
"Get Risk Modifiers For Endpoint"
|
|
],
|
|
"detection_searches": [
|
|
"Attempt To Set Default PowerShell Execution Policy To Unrestricted",
|
|
"Attempted Credential Dump From Registry Via Reg.exe",
|
|
"Detect Mimikatz Via PowerShell And EventCode 4703",
|
|
"Detect Mimikatz Via PowerShell And EventCode 4663"
|
|
],
|
|
"investigative_searches": [
|
|
"Get Process Info",
|
|
"Get Parent Process Info",
|
|
"Investigate Web Activity From Host"
|
|
],
|
|
"support_searches": []
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|