mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
36 lines
1.5 KiB
YAML
36 lines
1.5 KiB
YAML
name: Unsigned Image Loaded by LSASS
|
|
id: 56ef054c-76ef-45f9-af4a-a634695dcd65
|
|
version: 1
|
|
date: '2019-12-06'
|
|
description: This search detects loading of unsigned images by LSASS.
|
|
how_to_implement: This search needs Sysmon Logs with a sysmon configuration, which
|
|
includes EventCode 7 with lsass.exe. This search uses an input macro named `sysmon`.
|
|
We strongly recommend that you specify your environment-specific configurations
|
|
(index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
|
|
with configurations for your Splunk environment. The search also uses a post-filter
|
|
macro designed to filter out known false positives.
|
|
type: ESCU
|
|
references:
|
|
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
|
|
author: Patrick Bareiss, Splunk
|
|
search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false | stats count min(_time)
|
|
as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1
|
|
| rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|
|
| `unsigned_image_loaded_by_lsass_filter` '
|
|
known_false_positives: Other tools could load images into LSASS for legitimate reason.
|
|
But enterprise tools should always use signed DLLs.
|
|
tags:
|
|
analytics_story:
|
|
- Credential Dumping
|
|
mitre_attack_id:
|
|
- T1003.001
|
|
kill_chain_phases:
|
|
- Actions on Objectives
|
|
cis20:
|
|
- CIS 8
|
|
- CIS 16
|
|
nist:
|
|
- DE.CM
|
|
security_domain: endpoint
|
|
asset_type: Windows
|