Suspicious Access to LSA Secrets Registry

[rule]
description = """
Identifies access to the LSA Secrets policy registry hive by an unusual process. Adversaries with SYSTEM access to a
host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential
materials, such as credentials for service accounts.
"""
id = "c5ee8453-bc89-42e7-a414-1ba4bec85119"
license = "Elastic License v2"
name = "Suspicious Access to LSA Secrets Registry"
os_list = ["windows"]
reference = [
    "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets",
    "https://github.com/gtworek/PSBits/tree/master/LSASecretDumper",
]
version = "1.0.43"

query = '''
registry where event.action != "modification" and
 registry.path : ("HKLM\\SECURITY\\Policy\\Secrets\\*", "HKLM\\SECURITY\\CACHE*") and process.executable != null and
 user.id : "S-1-5-18" and
 not process.executable : ("?:\\Windows\\System32\\lsass.exe",
                           "\\Device\\HarddiskVolume?\\Windows\\System32\\lsass.exe",
                           "\\Device\\HarddiskVolume??\\Windows\\System32\\lsass.exe",
                           "?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\ToolsIQ.exe",
                           "?:\\Program Files\\Citrix\\PvsVm\\Service\\PvsVmAgent.exe",
                           "?:\\Windows\\Provisioning\\Autopilot\\DiagonsticAnalysis.pif",
                           "?:\\Program Files\\RepairTech\\LiveAgent\\SyncroLive.Agent.Runner.exe",
                           "?:\\Program Files\\Common Files\\Adobe\\Creative Cloud Libraries\\CCLibrary.exe",
                           "?:\\Windows\\System32\\SpecopsClient\\SecuredBrowserNet\\SecuredBrowserDotNetLauncher.exe",
                           "?:\\Program Files (x86)\\Tripwire\\TFS\\Bin\\tripwire.exe",
                           "?:\\Windows\\regedit.exe",
                           "?:\\Program Files\\Dell\\Dell Data Protection\\Encryption\\EmsService.exe",
                           "?:\\Program Files (x86)\\Imperva\\RemoteAgent\\RemoteAgentCtrl.exe",
                           "?:\\Program Files (x86)\\Lenovo\\System Update\\UACSdk.exe",
                           "?:\\Program Files (x86)\\CentraStage\\CagService.exe",
                           "?:\\Program Files\\McAfee\\Endpoint Security\\Adaptive Threat Protection\\mfeatp.exe",
                           "?:\\Program Files\\Bitdefender\\Endpoint Security\\EPSecurityService.exe",
                           // SenseIR.exe spawning powershell
                           "?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
                           "?:\\Program Files\\Neverfail\\R2\\bin\\NFServerR2.exe",
                           "C:\\Program Files (x86)\\AutoElevate\\AutoElevateAgent.exe",
                           "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\osqueryd.exe") and
 not (process.executable : "?:\\Windows\\System32\\dsregcmd.exe" and registry.path : "HKLM\\SECURITY\\Policy\\Secrets\\DSREGCMD\\MutexName") and
 not (process.executable : "?:\\Windows\\LTSvc\\LTSVC.exe" and registry.path : "HKLM\\SECURITY\\Cache\\NL$1") and
 not (process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and
      registry.path : "HKLM\\SECURITY\\Policy\\Secrets\\$MACHINE.ACC\\CupdTime\\") and
 not registry.path : "HKLM\\SECURITY\\Policy\\Secrets\\DSREGCMD\\MutexName" and
 not (process.code_signature.subject_name :
            ("Musarubra US LLC", "Bitdefender SRL", "Illusive Networks LTD", "Comodo Security Solutions, Inc.",
             "Proofpoint, Inc.", "Portnox Security LLC", "Urs Beckmann") and
      process.code_signature.trusted == true) and

 /* 8.6+ logs also failed attempts which generate some noise */
 not event.outcome == "failure" and

 not registry.path : ("HKLM\\SECURITY\\Policy\\Secrets\\_SC_Citrix Encryption Service\\*",
                      "HKLM\\SECURITY\\Policy\\Secrets\\$MACHINE.ACC\\CupdTime\\")
'''

min_endpoint_version = "8.0.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.004"
name = "LSA Secrets"
reference = "https://attack.mitre.org/techniques/T1003/004/"

[[threat.technique.subtechnique]]
id = "T1003.005"
name = "Cached Domain Credentials"
reference = "https://attack.mitre.org/techniques/T1003/005/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.0.0"