Credential Dumping Tools - Service Installation

Status: available
Severity: high
Time window: 1h
Group by: AccountName, Computer, EventID, ImagePath, ServiceName
Source: github.com/Azure/Azure-Sentinel

This query detects the installation of a Windows service that contains artifacts from credential dumping tools such as Mimikatz.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Service-Control-Manager	Event ID 7045: A service was installed in the system.

Rule body

id: 4ebbb5c2-8802-11ec-a8a3-0242ac120002
name: Credential Dumping Tools - Service Installation
description: |
   'This query detects the installation of a Windows service that contains artifacts from credential dumping tools such as Mimikatz.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - Event
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - Event
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1003.001
query: |
  // Enter a reference list of decoy users (usernames) "Case Sensitive"
  let MaliciousServiceArtifacts = dynamic (["fgexec","cachedump","mimikatz","mimidrv","wceservice","pwdump"]);
  Event
  | where Source == "Service Control Manager" and EventID == 7045
  | parse EventData with * 'ServiceName">' ServiceName "<" * 'ImagePath">' ImagePath "<" *
  | where ServiceName has_any (MaliciousServiceArtifacts) or ImagePath has_any (MaliciousServiceArtifacts)
  | parse EventData with * 'AccountName">' AccountName "<" *
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, ServiceName, ImagePath, AccountName
  | extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')
entityMappings:
- entityType: Account
  fieldMappings:
    - identifier: Name
      columnName: AccountName
- entityType: File
  fieldMappings:
    - identifier: Name
      columnName: ImagePath
- entityType: Host
  fieldMappings:
    - identifier: HostName
      columnName: HostName
    - identifier: DnsDomain
      columnName: DnsDomain
version: 1.0.3
kind: Scheduled

Stages and Predicates

Parameters

let MaliciousServiceArtifacts = dynamic (["fgexec","cachedump","mimikatz","mimidrv","wceservice","pwdump"]);

Stage 1: `source`

Event

Stage 2: `where`

| where Source == "Service Control Manager" and EventID == 7045

Stage 3: `parse`

| parse EventData with * 'ServiceName">' ServiceName "<" * 'ImagePath">' ImagePath "<" *

Stage 4: `where`

| where ServiceName has_any (MaliciousServiceArtifacts) or ImagePath has_any (MaliciousServiceArtifacts)

Stage 5: `parse`

| parse EventData with * 'AccountName">' AccountName "<" *

Stage 6: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, ServiceName, ImagePath, AccountName

Stage 7: `extend`

| extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventID`	eq	`7045` corpus 21 (splunk 18, elastic 1, chronicle 1, kusto 1)	`field:"EventID" kind:eq value:"7045"`
`ImagePath`	match	`cachedump` transforms: `term` corpus 2 (sigma 1, kusto 1) `fgexec` transforms: `term` corpus 2 (sigma 1, kusto 1) `mimidrv` transforms: `term` corpus 2 (sigma 1, kusto 1) `mimikatz` transforms: `term` `pwdump` transforms: `term` corpus 2 (sigma 1, kusto 1) `wceservice` transforms: `term`	`field:"ImagePath" kind:match`
`ServiceName`	match	`cachedump` transforms: `term` corpus 2 (sigma 1, kusto 1) `fgexec` transforms: `term` `mimidrv` transforms: `term` corpus 2 (sigma 1, kusto 1) `mimikatz` transforms: `term` corpus 2 (sigma 1, kusto 1) `pwdump` transforms: `term` corpus 2 (sigma 1, kusto 1) `wceservice` transforms: `term` corpus 2 (sigma 1, kusto 1)	`field:"ServiceName" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountName`	`summarize`
`Computer`	`summarize`
`EndTime`	`summarize`
`EventID`	`summarize`
`ImagePath`	`summarize`
`ServiceName`	`summarize`
`StartTime`	`summarize`
`DnsDomain`	`extend`
`HostName`	`extend`

Credential Dumping Tools - Service Installation

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Parameters

Stage 1: source

Stage 2: where

Stage 3: parse

Stage 4: where

Stage 5: parse

Stage 6: summarize

Stage 7: extend