mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
92 lines
3.1 KiB
YAML
92 lines
3.1 KiB
YAML
name: Dump LSASS via procdump
|
|
id: 3742ebfe-64c2-11eb-ae93-0242ac130002
|
|
version: 3
|
|
date: '2022-08-31'
|
|
author: Michael Haag, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: 'Detect procdump.exe dumping the lsass process. This query looks for
|
|
both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
|
|
file with all process memory. Both are highly suspect and should be reviewed. This
|
|
query does not monitor for the internal name (original_file_name=procdump) of the
|
|
PE or look for procdump64.exe. Modify the query as needed.
|
|
|
|
During triage, confirm this is procdump.exe executing. If it is the first time a
|
|
Sysinternals utility has been ran, it is possible there will be a -accepteula on
|
|
the command line. Review other endpoint data sources for cross process (injection)
|
|
into lsass.exe.'
|
|
data_source:
|
|
- Sysmon Event ID 1
|
|
search:
|
|
selection1:
|
|
OriginalFileName: procdump
|
|
selection2:
|
|
Image|endswith:
|
|
- procdump.exe
|
|
- procdump64.exe
|
|
selection3:
|
|
CommandLine:
|
|
- '*-ma*'
|
|
- '*-mm*'
|
|
selection4:
|
|
CommandLine: '*lsass*'
|
|
condition: (selection1 or selection2) and selection3 and selection4
|
|
how_to_implement: To successfully implement this search you need to be ingesting information
|
|
on process that include the name of the process responsible for the changes from
|
|
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
|
|
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
|
|
endpoint product.
|
|
known_false_positives: None identified.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1003/001/
|
|
- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
|
|
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
|
|
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
|
|
tags:
|
|
analytic_story:
|
|
- Credential Dumping
|
|
- HAFNIUM Group
|
|
- CISA AA22-257A
|
|
asset_type: Endpoint
|
|
confidence: 100
|
|
impact: 80
|
|
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
|
attempting to dump lsass.exe on endpoint $dest$ by user $user$.
|
|
mitre_attack_id:
|
|
- T1003.001
|
|
- T1003
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: parent_process_name
|
|
type: Process
|
|
role:
|
|
- Parent Process
|
|
- name: process_name
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
risk_score: 80
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: xmlwineventlog
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log
|
|
source: crowdstrike
|
|
sourcetype: crowdstrike:events:sensor
|