SAM database user credentials dump with Mimikatz

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker dump the LSASS memory content using Mimikatz (sekurlsa module).

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4661: A handle to an object was requested.

Rule body

title: SAM database user credentials dump with Mimikatz
description: Detects scenarios where an attacker dump the LSASS memory content using Mimikatz (sekurlsa module).
correlation: correlate TargetLogonId from ID 4624 with SubjectLogonId from ID 4661 to identify the source of the enumeration.
requirements: extended rights auditing enabled (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html)
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://ivanitlearning.wordpress.com/2019/09/07/mimikatz-and-password-dumps/
tags:
- attack.credential_access
- attack.t1003.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4661
    ProcessName|endswith: '\lsass.exe'
    ObjectServer: Security Account Manager
    ObjectType: SAM_USER
    ObjectName|startswith: 'S-1-5-21-' # User SID dumped
    AccessList|contains|all:
      - '%%5446' # ChangePassword
      - '%%5447' # SetPassword
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter | count(ObjectName) by Computer > 10
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter | count(ObjectName) by Computer > 10

Stage 1: `selection`

selection:
  EventID: 4661
  ProcessName|endswith: '\lsass.exe'
  ObjectServer: Security Account Manager
  ObjectType: SAM_USER
  ObjectName|startswith: 'S-1-5-21-'
  AccessList|contains|all:
    - '%%5446'
    - '%%5447'

Threshold: > 10

Stage 2: `not filter`

filter:
  SubjectUserName|endswith: '$'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserName`	ends_with	`$`	`excludes:SubjectUserName` `field:"SubjectUserName" value:"$"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AccessList`	match	`%%5446` `%%5447` corpus 2 (sigma 2)	`field:"AccessList" kind:match`
`ObjectName`	starts_with	`S-1-5-21-` corpus 5 (sigma 5)	`field:"ObjectName" kind:starts_with value:"S-1-5-21-"`
`ObjectServer`	eq	`Security Account Manager` corpus 7 (sigma 7)	`field:"ObjectServer" kind:eq value:"Security Account Manager"`
`ObjectType`	eq	`SAM_USER` corpus 5 (sigma 5)	`field:"ObjectType" kind:eq value:"SAM_USER"`
`ProcessName`	ends_with	`\lsass.exe` corpus 7 (sigma 7)	`field:"process_name" kind:ends_with value:"\lsass.exe"`

SAM database user credentials dump with Mimikatz

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Stage 2: not filter

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection`

Stage 2: `not filter`