HackTool - HandleKatz LSASS Dumper Execution

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: HackTool - HandleKatz LSASS Dumper Execution
id: ca621ba5-54ab-4035-9942-d378e6fcde3c
status: test
description: Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same
references:
    - https://github.com/codewhitesec/HandleKatz
author: Florian Roth (Nextron Systems)
date: 2022-08-18
modified: 2024-11-23
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_loader_img:
        Image|endswith: '\loader.exe'
        CommandLine|contains: '--pid:'
    selection_loader_imphash:
        Hashes|contains:
            - 'IMPHASH=38D9E015591BBFD4929E0D0F47FA0055'
            - 'IMPHASH=0E2216679CA6E1094D63322E3412D650'
    selection_flags:
        CommandLine|contains|all:
            - '--pid:'
            - '--outfile:'
        CommandLine|contains:
            - '.dmp'
            - 'lsass'
            - '.obf'
            - 'dump'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_loader_img`

selection_loader_img:
    Image|endswith: '\loader.exe'
    CommandLine|contains: '--pid:'

Stage 2: `selection_loader_imphash`

selection_loader_imphash:
    Hashes|contains:
        - 'IMPHASH=38D9E015591BBFD4929E0D0F47FA0055'
        - 'IMPHASH=0E2216679CA6E1094D63322E3412D650'

Stage 3: `selection_flags`

selection_flags:
    CommandLine|contains|all:
        - '--pid:'
        - '--outfile:'
    CommandLine|contains:
        - '.dmp'
        - 'lsass'
        - '.obf'
        - 'dump'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`--outfile:` `--pid:` `.dmp` corpus 10 (sigma 8, chronicle 2) `.obf` `dump` `lsass` corpus 10 (sigma 6, kusto 2, elastic 1, chronicle 1)	`field:"CommandLine" kind:match`
`Hashes`	match	`IMPHASH=0E2216679CA6E1094D63322E3412D650` corpus 3 (sigma 3) `IMPHASH=38D9E015591BBFD4929E0D0F47FA0055` corpus 3 (sigma 3)	`field:"Hashes" kind:match`
`Image`	ends_with	`\loader.exe`	`field:"Image" kind:ends_with value:"\loader.exe"`