mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
70 lines
2.3 KiB
YAML
70 lines
2.3 KiB
YAML
name: Create Remote Thread into LSASS
|
|
id: 67d4dbef-9564-4699-8da8-03a151529edc
|
|
version: 1
|
|
date: '2019-12-06'
|
|
author: Patrick Bareiss, Splunk
|
|
type: TTP
|
|
datamodel: []
|
|
description: Detect remote thread creation into LSASS consistent with credential dumping.
|
|
search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime
|
|
max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId | rename
|
|
Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|
|
| `create_remote_thread_into_lsass_filter`'
|
|
how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which
|
|
includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`.
|
|
We strongly recommend that you specify your environment-specific configurations
|
|
(index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
|
|
with configurations for your Splunk environment. The search also uses a post-filter
|
|
macro designed to filter out known false positives.
|
|
known_false_positives: Other tools can access LSASS for legitimate reasons and generate
|
|
an event. In these cases, tweaking the search may help eliminate noise.
|
|
references:
|
|
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
|
|
tags:
|
|
analytic_story:
|
|
- Credential Dumping
|
|
asset_type: Windows
|
|
cis20:
|
|
- CIS 8
|
|
- CIS 16
|
|
confidence: 90
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Credential Access
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
|
|
impact: 90
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: A process has created a remote thread into $TargetImage$ on $dest$. This
|
|
behavior is indicative of credential dumping and should be investigated.
|
|
mitre_attack_id:
|
|
- T1003.001
|
|
- T1003
|
|
nist:
|
|
- DE.CM
|
|
observable:
|
|
- name: TargetImage
|
|
type: Other
|
|
role:
|
|
- Other
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- EventID
|
|
- TargetImage
|
|
- Computer
|
|
- EventCode
|
|
- TargetImage
|
|
- TargetProcessId
|
|
- dest
|
|
risk_score: 81
|
|
security_domain: endpoint
|