mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
65 lines
3.2 KiB
YAML
65 lines
3.2 KiB
YAML
name: Create Remote Thread into LSASS
|
|
id: 67d4dbef-9564-4699-8da8-03a151529edc
|
|
version: 1
|
|
date: '2019-12-06'
|
|
author: Patrick Bareiss, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: "The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS), which is a common tactic used by adversaries to steal user authentication credentials, known as credential dumping. The detection is made by leveraging Sysmon Event ID 8 logs and searches for processes that create remote threads in lsass.exe. This is an unusual activity that is generally linked to credential theft or credential dumping, which is a significant threat to network security. The detection is important because it helps to detect potential credential dumping attacks, which can result in significant damage to an organization's security. False positives might occur though the confidence level of this alert is high. There might be cases where legitimate tools can access LSASS and generate similar logs. Therefore, you must understand the broader context of such events and differentiate between legitimate activities and possible threats."
|
|
data_source:
|
|
- Sysmon Event ID 8
|
|
search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime
|
|
max(_time) as lastTime by dest, EventCode, TargetImage, TargetProcessId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|
|
| `create_remote_thread_into_lsass_filter`'
|
|
how_to_implement: This search needs Sysmon Logs with a Sysmon configuration, which
|
|
includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`.
|
|
We strongly recommend that you specify your environment-specific configurations
|
|
(index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
|
|
with configurations for your Splunk environment. The search also uses a post-filter
|
|
macro designed to filter out known false positives.
|
|
known_false_positives: Other tools can access LSASS for legitimate reasons and generate
|
|
an event. In these cases, tweaking the search may help eliminate noise.
|
|
references:
|
|
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
|
|
tags:
|
|
analytic_story:
|
|
- Credential Dumping
|
|
asset_type: Windows
|
|
confidence: 90
|
|
impact: 90
|
|
message: A process has created a remote thread into $TargetImage$ on $dest$. This
|
|
behavior is indicative of credential dumping and should be investigated.
|
|
mitre_attack_id:
|
|
- T1003.001
|
|
- T1003
|
|
observable:
|
|
- name: TargetImage
|
|
type: Other
|
|
role:
|
|
- Other
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- EventID
|
|
- TargetImage
|
|
- dest
|
|
- EventCode
|
|
- TargetImage
|
|
- TargetProcessId
|
|
- dest
|
|
risk_score: 81
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: xmlwineventlog
|