Credential Dumping Tools - File Artifacts

Status: available
Severity: high
Time window: 1h
Group by: Computer, EventID, Image, ProcessGuid, TargetFilename
Source: github.com/Azure/Azure-Sentinel

This query detects the creation of credential dumping tools files. Several credential dumping tools export files with hardcoded file names. Ref: https://jpcertcc.github.io/ToolAnalysisResultSheet/

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

id: 32ffb19e-8ed8-40ed-87a0-1adb4746b7c4
name: Credential Dumping Tools - File Artifacts
description: |
   'This query detects the creation of credential dumping tools files. Several credential dumping tools export files with hardcoded file names.
   Ref: https://jpcertcc.github.io/ToolAnalysisResultSheet/'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - Event
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - Event
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1003.001
query: |
  // Enter a reference list of malicious file artifacts
  let MaliciousFileArtifacts = dynamic (["lsass.dmp","test.pwd","lsremora.dll","lsremora64.dll","fgexec.exe","pwdump","kirbi","wce_ccache","wce_krbtkts","wceaux.dll","PwHashes","SAM.out","SECURITY.out","SYSTEM.out","NTDS.out" "DumpExt.dll","DumpSvc.exe","cachedump64.exe","cachedump.exe","pstgdump.exe","servpw64.exe","servpw.exe","pwdump.exe","fgdump-log"]);
  Event
  | where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID==11
  | parse EventData with * 'TargetFilename">' TargetFilename "<" *
  | where TargetFilename has_any (MaliciousFileArtifacts)
  | parse EventData with * 'ProcessGuid">' ProcessGuid "<" * 'Image">' Image "<" *
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, Image, ProcessGuid, TargetFilename
  | extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')
entityMappings:
- entityType: File
  fieldMappings:
    - identifier: Name
      columnName: TargetFilename
- entityType: Host
  fieldMappings:
    - identifier: HostName
      columnName: HostName
    - identifier: DnsDomain
      columnName: DnsDomain
- entityType: Process
  fieldMappings:
    - identifier: CommandLine
      columnName: Image
version: 1.0.3
kind: Scheduled

Stages and Predicates

Let binding: `MaliciousFileArtifacts` used in Stage 4

let MaliciousFileArtifacts = dynamic (["lsass.dmp","test.pwd","lsremora.dll","lsremora64.dll","fgexec.exe","pwdump","kirbi","wce_ccache","wce_krbtkts","wceaux.dll","PwHashes","SAM.out","SECURITY.out","SYSTEM.out","NTDS.out" "DumpExt.dll","DumpSvc.exe","cachedump64.exe","cachedump.exe","pstgdump.exe","servpw64.exe","servpw.exe","pwdump.exe","fgdump-log"]);

Stage 1: `source`

Event

Stage 2: `where`

| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID==11

Stage 3: `parse`

| parse EventData with * 'TargetFilename">' TargetFilename "<" *

Stage 4: `where`

| where TargetFilename has_any (MaliciousFileArtifacts)

Stage 5: `parse`

| parse EventData with * 'ProcessGuid">' ProcessGuid "<" * 'Image">' Image "<" *

Stage 6: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, Image, ProcessGuid, TargetFilename

Stage 7: `extend`

| extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventID`	eq	`11` corpus 26 (splunk 24, kusto 2)	`field:"EventID" kind:eq value:"11"`
`EventLog`	eq	`Microsoft-Windows-Sysmon/Operational` corpus 3 (kusto 3)	`field:"EventLog" kind:eq value:"Microsoft-Windows-Sysmon/Operational"`
`TargetFilename`	match	`DumpExt.dll` transforms: `term` `DumpSvc.exe` transforms: `term` `NTDS.out` transforms: `term` `PwHashes` transforms: `term` `SAM.out` transforms: `term` `SECURITY.out` transforms: `term` `SYSTEM.out` transforms: `term` `cachedump.exe` transforms: `term` `cachedump64.exe` transforms: `term` `fgdump-log` transforms: `term` `fgexec.exe` transforms: `term` `kirbi` transforms: `term` `lsass.dmp` transforms: `term` `lsremora.dll` transforms: `term` `lsremora64.dll` transforms: `term` `pstgdump.exe` transforms: `term` `pwdump` transforms: `term` `pwdump.exe` transforms: `term` `servpw.exe` transforms: `term` `servpw64.exe` transforms: `term` `test.pwd` transforms: `term` `wce_ccache` transforms: `term` `wce_krbtkts` transforms: `term` `wceaux.dll` transforms: `term`	`field:"TargetFilename" kind:match`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Computer`	`summarize`
`EndTime`	`summarize`
`EventID`	`summarize`
`Image`	`summarize`
`ProcessGuid`	`summarize`
`StartTime`	`summarize`
`TargetFilename`	`summarize`
`DnsDomain`	`extend`
`HostName`	`extend`

Credential Dumping Tools - File Artifacts

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Let binding: MaliciousFileArtifacts used in Stage 4

Stage 1: source

Stage 2: where

Stage 3: parse

Stage 4: where

Stage 5: parse

Stage 6: summarize

Stage 7: extend