splunk-security_content/detections/endpoint/windows_terminating_lsass_process.yml

name: Windows Terminating Lsass Process
id: 7ab3c319-a4e7-4211-9e8c-40a049d0dba6
version: 2
date: '2024-05-23'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a suspicious process attempting to terminate
  the Lsass.exe process. It leverages Sysmon EventCode 10 logs to identify processes
  granted PROCESS_TERMINATE access to Lsass.exe. This activity is significant because
  Lsass.exe is a critical process responsible for enforcing security policies and
  handling user credentials. If confirmed malicious, this behavior could indicate
  an attempt to perform credential dumping, privilege escalation, or evasion of security
  policies, potentially leading to unauthorized access and persistence within the
  environment.
data_source:
- Sysmon EventID 10
search: '`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess = 0x1 | stats
  count min(_time) as firstTime max(_time) as lastTime by SourceImage, TargetImage,
  TargetProcessId, SourceProcessId, GrantedAccess CallTrace, dest | rename dest as
  dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_terminating_lsass_process_filter`'
how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which
  includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`.
  We strongly recommend that you specify your environment-specific configurations
  (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
  with configurations for your Splunk environment. The search also uses a post-filter
  macro designed to filter out known false positives.
known_false_positives: unknown
references:
- https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html
tags:
  analytic_story:
  - Data Destruction
  - Double Zero Destructor
  asset_type: Endpoint
  confidence: 80
  impact: 80
  message: a process $SourceImage$ terminates Lsass process in $dest$
  mitre_attack_id:
  - T1562.001
  - T1562
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  - name: TargetImage
    type: Process
    role:
    - Target
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - TargetImage
  - CallTrace
  - dest
  - TargetProcessId
  - SourceImage
  - SourceProcessId
  - GrantedAccess
  risk_score: 64
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog