mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
79 lines
3.4 KiB
YAML
79 lines
3.4 KiB
YAML
category:
|
|
- Adversary Tactics
|
|
channel: ESCU
|
|
creation_date: '2018-08-08'
|
|
description: Uncover activity consistent with credential dumping, a technique wherein
|
|
attackers compromise systems and attempt to obtain and exfiltrate passwords. The
|
|
threat actors use these pilfered credentials to further escalate privileges and
|
|
spread throughout a target environment. The included searches in this Analytic Story
|
|
are designed to identify attempts to credential dumping.
|
|
detections:
|
|
- detection_id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717
|
|
name: Access LSASS Memory for Dump Creation
|
|
type: splunk
|
|
- detection_id: 67d4dbef-9564-4699-8da8-03a151529edc
|
|
name: Create Remote Thread into LSASS
|
|
type: splunk
|
|
- detection_id: 2c365e57-4414-4540-8dc0-73ab10729996
|
|
name: Detect Credential Dumping through LSASS access
|
|
type: splunk
|
|
- detection_id: 56ef054c-76ef-45f9-af4a-a634695dcd65
|
|
name: Unsigned Image Loaded by LSASS
|
|
type: splunk
|
|
- detection_id: 14038953-e5f2-4daf-acff-5452062baf03
|
|
name: Attempted Credential Dump From Registry via Reg.exe
|
|
type: splunk
|
|
- detection_id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0
|
|
name: Detect Mimikatz Using Loaded Images
|
|
type: splunk
|
|
- detection_id: c2590137-0b08-4985-9ec5-6ae23d92f63d
|
|
name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass
|
|
type: splunk
|
|
- detection_id: eb120f5f-b879-4a63-97c1-93352b5df844
|
|
name: Creation of Shadow Copy
|
|
type: splunk
|
|
- detection_id: 2ed8b538-d284-449a-be1d-82ad1dbd186b
|
|
name: Creation of Shadow Copy with wmic and powershell
|
|
type: splunk
|
|
- detection_id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b
|
|
name: Credential Dumping via Copy Command from Shadowcopy
|
|
type: splunk
|
|
- detection_id: c5eac648-fae0-4263-91a6-773df1f4c903
|
|
name: Credential Dumping via Symlink to Shadowcopy
|
|
type: splunk
|
|
id: 854d78bf-d0e2-4f4e-b05c-640905f86d7a
|
|
maintainers:
|
|
- company: Splunk
|
|
email: rvaldez@splunk.com
|
|
name: Rico Valdez
|
|
- company: Splunk
|
|
email: pbareiss@splunk.com
|
|
name: Patrick Bareiss
|
|
modification_date: '2019-12-11'
|
|
name: Credential Dumping
|
|
narrative: 'Credential dumping—gathering credentials from a target system, often
|
|
hashed or encrypted—is a common attack technique. Even though the credentials
|
|
may not be in plain text, an attacker can still exfiltrate the data and set to cracking
|
|
it offline, on their own systems. The threat actors target a variety of sources
|
|
to extract them, including the Security Accounts Manager (SAM), Local Security Authority
|
|
(LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\
|
|
|
|
Once attackers obtain valid credentials, they use them to move throughout a target
|
|
network with ease, discovering new systems and identifying assets of interest. Credentials
|
|
obtained in this manner typically include those of privileged users, which may provide
|
|
access to more sensitive information and system operations.\
|
|
|
|
The detection searches in this Analytic Story monitor access to the Local Security
|
|
Authority Subsystem Service (LSASS) process, the usage of shadowcopies for credential
|
|
dumping and some other techniques for credential dumping.'
|
|
original_authors:
|
|
- company: Splunk
|
|
email: rvaldez@splunk.com
|
|
name: Rico Valdez
|
|
references:
|
|
- https://attack.mitre.org/wiki/Technique/T1003
|
|
- https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html
|
|
spec_version: 2
|
|
usecase: Advanced Threat Detection
|
|
version: '2.0'
|