Detection rules › Panther
Windows Credential Dumping Tool
Detects execution of tools commonly used for credential dumping on Windows systems. These tools can extract OAuth refresh tokens (GAIA), passwords, and authentication secrets from Windows memory (LSASS) and registry.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1003.001 OS Credential Dumping: LSASS Memory |
Rule body yaml
AnalysisType: rule
DisplayName: "Windows Credential Dumping Tool"
RuleID: "Windows.Credential.Dumping.Tool"
Description: >
Detects execution of tools commonly used for credential dumping on Windows systems.
These tools can extract OAuth refresh tokens (GAIA), passwords, and authentication secrets
from Windows memory (LSASS) and registry.
Enabled: true
CreateAlert: false
Filename: windows_credential_dumping_tool.py
Reference: https://businessinsights.bitdefender.com/the-chain-reaction-new-methods-for-extending-local-breaches-in-google-workspace
Runbook: |
1. Query Windows.EventLogs for all process creation events (EventID 4688 or Sysmon EventID 1) on the Computer hostname in the 1 hour before and after the alert to identify the full scope of malicious activity and parent processes
2. Check if the process was executed by a privileged account by reviewing the ExtraEventData SubjectUserName field, and search for other suspicious processes spawned by the same ParentProcessName to identify potential lateral movement
Severity: High
LogTypes:
- Windows.EventLogs
DedupPeriodMinutes: 60
Tags:
- Windows
- Credential Access
- GAIA
- Mimikatz
- OAuth
- T1003
Reports:
MITRE ATT&CK:
- TA0006:T1003
- TA0006:T1003.001
SummaryAttributes:
- computer
- p_any_usernames
Tests:
- Name: Mimikatz Execution Event ID 4688
ExpectedResult: true
Log:
EventID: "4688"
ProviderName: "Microsoft-Windows-Security-Auditing"
TimeCreated: "2024-01-15 10:30:45 +0000"
Computer: "WIN-WORKSTATION-01"
Channel: "Security"
EventRecordID: "12345678"
Level: "0"
UserID: "S-1-5-21-123456789-123456789-123456789-1001"
Message: "A new process has been created..."
MessageTitle: "A new process has been created"
ExtraEventData:
SubjectUserSid: "S-1-5-21-123456789-123456789-123456789-1001"
SubjectUserName: "jdoe"
SubjectDomainName: "CORP"
SubjectLogonId: "0x3e7"
NewProcessId: "0x1234"
NewProcessName: "C:\\Users\\jdoe\\Downloads\\mimikatz.exe"
TokenElevationType: "%%1936"
ProcessId: "0x5678"
CommandLine: "mimikatz.exe privilege::debug sekurlsa::logonpasswords"
ParentProcessName: "C:\\Windows\\System32\\cmd.exe"
p_log_type: "Windows.EventLogs"
p_event_time: "2024-01-15 10:30:45.000000000"
- Name: Benign Process Execution
ExpectedResult: false
Log:
EventID: "4688"
ProviderName: "Microsoft-Windows-Security-Auditing"
TimeCreated: "2024-01-15 09:00:00 +0000"
Computer: "WIN-WORKSTATION-01"
Channel: "Security"
EventRecordID: "11111111"
Level: "0"
UserID: "S-1-5-21-123456789-123456789-123456789-1001"
Message: "A new process has been created..."
MessageTitle: "A new process has been created"
ExtraEventData:
SubjectUserSid: "S-1-5-21-123456789-123456789-123456789-1001"
SubjectUserName: "jdoe"
SubjectDomainName: "CORP"
SubjectLogonId: "0x3e7"
NewProcessId: "0x9999"
NewProcessName: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
TokenElevationType: "%%1936"
ProcessId: "0x8888"
CommandLine: '"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"'
ParentProcessName: "C:\\Windows\\explorer.exe"
p_log_type: "Windows.EventLogs"
p_event_time: "2024-01-15 09:00:00.000000000"
Detection logic
Condition
EventID in ["4688", "1"]
ExtraEventData.NewProcessName is_not_null
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventID | in |
|
ExtraEventData.NewProcessName | is_not_null |
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
computer | Computer |
user_sid | UserID |
process_name | ExtraEventData.NewProcessName |
command_line | ExtraEventData.CommandLine |
parent_process | ExtraEventData.ParentProcessName |
process_id | ExtraEventData.NewProcessId |
event_id | EventID |