Dumping LSASS Process Into a File

Status: available
Severity: high
Time window: 1h
Group by: CallTrace, Computer, EventID, GrantedAccess, SourceImage, SourceProcessGUID, TargetImage
Source: github.com/Azure/Azure-Sentinel

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or system and used to conduct lateral movement using alternate authentication materials. As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system. Ref: https://attack.mitre.org/techniques/T1003/001/

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 10: ProcessAccess

Rule body

id: a7b9df32-1367-402d-b385-882daf6e3020
name: Dumping LSASS Process Into a File
description: | 
  'Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
  After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.
  These credential materials can be harvested by an administrative user or system and used to conduct lateral movement using alternate authentication materials.
  As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.
  Ref: https://attack.mitre.org/techniques/T1003/001/'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1003.001
query: |
  Event
  | where EventLog =~ "Microsoft-Windows-Sysmon/Operational" and EventID==10
  | parse EventData with * 'TargetImage">' TargetImage "<" * 'GrantedAccess">' GrantedAccess "<" * 'CallTrace">' CallTrace "<" * 
  | where GrantedAccess =~ "0x1FFFFF" and TargetImage =~ "C:\\Windows\\System32\\lsass.exe" and CallTrace has_any ("dbghelp.dll","dbgcore.dll")
  | parse EventData with * 'SourceProcessGUID">' SourceProcessGUID "<" * 'SourceImage">' SourceImage "<" *
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, SourceProcessGUID, SourceImage, GrantedAccess, TargetImage, CallTrace
  | extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: SourceImage
version: 1.0.3
kind: Scheduled

Stages and Predicates

Stage 1: `source`

Event

Stage 2: `where`

| where EventLog =~ "Microsoft-Windows-Sysmon/Operational" and EventID==10

Stage 3: `parse`

| parse EventData with * 'TargetImage">' TargetImage "<" * 'GrantedAccess">' GrantedAccess "<" * 'CallTrace">' CallTrace "<" *

Stage 4: `where`

| where GrantedAccess =~ "0x1FFFFF" and TargetImage =~ "C:\\Windows\\System32\\lsass.exe" and CallTrace has_any ("dbghelp.dll","dbgcore.dll")

Stage 5: `parse`

| parse EventData with * 'SourceProcessGUID">' SourceProcessGUID "<" * 'SourceImage">' SourceImage "<" *

Stage 6: `summarize`

| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, SourceProcessGUID, SourceImage, GrantedAccess, TargetImage, CallTrace

Stage 7: `extend`

| extend HostName = iif(Computer has '.',substring(Computer,0,indexof(Computer,'.')),Computer) , DnsDomain = iif(Computer has '.',substring(Computer,indexof(Computer,'.')+1),'')

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CallTrace`	match	`dbgcore.dll` transforms: `term` corpus 4 (sigma 2, splunk 1, kusto 1) `dbghelp.dll` transforms: `term` corpus 4 (sigma 2, splunk 1, kusto 1)	`field:"CallTrace" kind:match`
`EventID`	eq	`10` corpus 23 (splunk 16, elastic 6, kusto 1)	`field:"EventID" kind:eq value:"10"`
`EventLog`	eq	`Microsoft-Windows-Sysmon/Operational` corpus 7 (kusto 7)	`field:"EventLog" kind:eq value:"Microsoft-Windows-Sysmon/Operational"`
`GrantedAccess`	eq	`0x1FFFFF` corpus 9 (sigma 7, splunk 1, kusto 1)	`field:"GrantedAccess" kind:eq value:"0x1FFFFF"`
`TargetImage`	eq	`C:\Windows\System32\lsass.exe` corpus 2 (elastic 1, kusto 1)	`field:"TargetImage" kind:eq value:"C:\Windows\System32\lsass.exe"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`CallTrace`	`summarize`
`Computer`	`summarize`
`EndTime`	`summarize`
`EventID`	`summarize`
`GrantedAccess`	`summarize`
`SourceImage`	`summarize`
`SourceProcessGUID`	`summarize`
`StartTime`	`summarize`
`TargetImage`	`summarize`
`DnsDomain`	`extend`
`HostName`	`extend`

Dumping LSASS Process Into a File

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: parse

Stage 4: where

Stage 5: parse

Stage 6: summarize

Stage 7: extend