LSASS credential dump with LSASSY (kernel access)

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.

Known false positives

Antivirus, security products, browsers

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4656: A handle to an object was requested.
Security-Auditing	Event ID 4663: An attempt was made to access an object.

Rule body

title: LSASS credential dump with LSASSY (kernel access)
description: Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://github.com/Hackndo/lsassy
tags:
- attack.credential_access
- attack.t1003.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4656 # A handle to an object was requested (Kernel object).
      - 4663 # An attempt was made to access an object (Kernel object).
    ObjectType: Process
    ObjectServer: Security
    ProcessName|endswith: '\rundll32.exe'
    ObjectName|endswith: '\lsass.exe'
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter
falsepositives:
- Antivirus, security products, browsers
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID:
    - 4656
    - 4663
  ObjectType: Process
  ObjectServer: Security
  ProcessName|endswith: '\rundll32.exe'
  ObjectName|endswith: '\lsass.exe'

Stage 2: `not filter`

filter:
  SubjectUserName|endswith: '$'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserName`	ends_with	`$`	`excludes:SubjectUserName` `field:"SubjectUserName" value:"$"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectName`	ends_with	`\lsass.exe` corpus 4 (sigma 4)	`field:"ObjectName" kind:ends_with value:"\lsass.exe"`
`ObjectServer`	eq	`Security` corpus 5 (sigma 5)	`field:"ObjectServer" kind:eq value:"Security"`
`ObjectType`	eq	`Process` corpus 4 (sigma 3, elastic 1)	`field:"ObjectType" kind:eq value:"Process"`
`ProcessName`	ends_with	`\rundll32.exe`	`field:"process_name" kind:ends_with value:"\rundll32.exe"`

LSASS credential dump with LSASSY (kernel access)

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Stage 2: not filter

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection`

Stage 2: `not filter`