Detection: Detect Credential Dumping through LSASS access

Description

The following analytic detects attempts to read LSASS memory, indicative of credential dumping. It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe.

Search

1`sysmon`
2EventCode=10
3TargetImage="*\\lsass.exe"

Convert GrantedAccess from hexadecimal to decimal. Match "PROCESS_VM_READ" with either "PROCESS_QUERY_LIMITED_INFORMATION" or "PROCESS_QUERY_INFORMATION", which represent the either the "0x1010" or "0x1410" hexadecimal masks.

 1
 2| eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16)
 3
 4| eval PROCESS_VM_READ = 16
 5
 6| eval PROCESS_QUERY_LIMITED_INFORMATION = 4096
 7
 8| eval PROCESS_QUERY_INFORMATION = 1024
 9
10| eval vm_read_set = bit_and(g_access_decimal, PROCESS_VM_READ)
11
12| eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION)
13
14| eval query_information_set = bit_and(g_access_decimal, PROCESS_QUERY_INFORMATION)
15
16| where vm_read_set == PROCESS_VM_READ
17  AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION
18  AND (query_information_set == 0 OR query_information_set == PROCESS_QUERY_INFORMATION)
19
20
21| stats count min(_time) as firstTime
22                max(_time) as lastTime
23    BY user_id dest
24       signature_id signature granted_access Opcode
25       SourceImage SourceProcessGUID SourceProcessId
26       TargetImage TargetProcessGUID TargetProcessId
27       CallTrace vendor_product
28
29
30| eval CallTrace=split(CallTrace, "
31|")
32
33
34| `security_content_ctime(firstTime)`
35
36| `security_content_ctime(lastTime)`
37
38| `detect_credential_dumping_through_lsass_access_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 10	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named sysmon. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.

Known False Positives

The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.

Associated Analytic Story

• CISA AA23-347A

• Credential Dumping

• BlackSuit Ransomware

• Detect Zerologon Attack

• Lokibot

• Scattered Lapsus$ Hunters

Finding

Threat Objects

References

• https://attack.mitre.org/techniques/T1003/001/

• https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 16