mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Michael Haag
100 lines
4.1 KiB
YAML
100 lines
4.1 KiB
YAML
name: Windows Possible Credential Dumping
|
|
id: e4723b92-7266-11ec-af45-acde48001122
|
|
version: 3
|
|
date: '2022-08-24'
|
|
author: Michael Haag, Splunk
|
|
type: TTP
|
|
datamodel: []
|
|
description: 'The following analytic is an enhanced version of two previous analytics
|
|
that identifies common GrantedAccess permission requests and CallTrace DLLs in order
|
|
to detect credential dumping. \
|
|
|
|
GrantedAccess is the requested permissions by the SourceImage into the TargetImage.
|
|
\
|
|
|
|
CallTrace Stack trace of where open process is called. Included is the DLL and the
|
|
relative virtual address of the functions in the call stack right before the open
|
|
process call. \
|
|
|
|
dbgcore.dll or dbghelp.dll are two core Windows debug DLLs that have minidump functions
|
|
which provide a way for applications to produce crashdump files that contain a useful
|
|
subset of the entire process context. \
|
|
|
|
The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
|
|
For example in sekurlsa module there are many ntdll exported api, like RtlCopyMemory,
|
|
used to execute this module which is related to lsass dumping.'
|
|
search: '`sysmon` EventCode=10 TargetImage=*\\lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*", "*kernelbase.dll*", "*kernel32.dll*") NOT SourceUser IN ("NT AUTHORITY\\SYSTEM", "NT AUTHORITY\\NETWORK SERVICE")| stats count min(_time) as firstTime max(_time) as lastTime by, Computer, SourceImage, GrantedAccess, TargetImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
|
|
| `windows_possible_credential_dumping_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be ingesting
|
|
logs with the process name, parent process, and command-line executions from your
|
|
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
|
Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
|
|
known_false_positives: False positives will occur based on GrantedAccess 0x1010 and
|
|
0x1400, filter based on source image as needed or remove them. Concern is Cobalt
|
|
Strike usage of Mimikatz will generate 0x1010 initially, but later be caught.
|
|
references:
|
|
- https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
|
|
- https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
|
|
- https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
|
|
- https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1
|
|
- https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN
|
|
- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1003.001_DumpLSASS/DumpLSASS.ps1
|
|
tags:
|
|
analytic_story:
|
|
- Credential Dumping
|
|
- Detect Zerologon Attack
|
|
- DarkSide Ransomware
|
|
- CISA AA22-257A
|
|
- CISA AA22-264A
|
|
automated_detection_testing: passed
|
|
confidence: 80
|
|
context:
|
|
- Source:Endpoint
|
|
- Stage:Credential Access
|
|
dataset:
|
|
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon_creddump.log
|
|
impact: 80
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
message: A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related
|
|
to credential dumping on $dest$. Review for further details.
|
|
mitre_attack_id:
|
|
- T1003.001
|
|
- T1003
|
|
nist:
|
|
- DE.AE
|
|
- DE.CM
|
|
observable:
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: ImageLoaded
|
|
type: Process
|
|
role:
|
|
- Other
|
|
- name: SourceImage
|
|
type: Process
|
|
role:
|
|
- Child Process
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Computer
|
|
- TargetImage
|
|
- GrantedAccess
|
|
- SourceImage
|
|
- SourceProcessId
|
|
- SourceUser
|
|
- TargetUser
|
|
risk_score: 64
|
|
security_domain: endpoint
|
|
asset_type: Endpoint
|