LSASS credential dump with LSASSY (process)

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: LSASS credential dump with LSASSY (process)
description: Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://github.com/Hackndo/lsassy
tags:
- attack.credential_access
- attack.t1003.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection: # Full command: '"C:\Windows\System32\rundll32.exe" C:\Windows\System32\comsvcs.dll MiniDump 512 \Windows\Temp\76nivOxA.dmp full'
  selection_process_native:
    NewProcessName|endswith:
      - \rundll32.exe
      - \powershell.exe
    CommandLine|contains|all:
      - rundll32.exe
      - comsvcs.dll
      #- '.dmp' # Extension can be changed in source code

  selection_sysmon_baseline:
    Image|endswith:
      - \rundll32.exe
      - \powershell.exe
      - \pwsh.exe # PowerShell v6
      - \powershell_ise.exe # Development GUI
  selection_sysmon_parent_process:
    ParentCommandLine:
      - rundll32.exe
      - comsvcs.dll
      #- '.dmp' # Extension can be changed in source code
  selection_sysmon_process:
    CommandLine|contains|all:
      - rundll32.exe
      - comsvcs.dll
      #- '.dmp' # Extension can be changed in source code
  condition: selection_process_native or (selection_sysmon_baseline and (selection_sysmon_parent_process or selection_sysmon_process))
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection_process_native or (selection_sysmon_baseline and (selection_sysmon_parent_process or selection_sysmon_process))

Stage 1: `selection_process_native`

selection_process_native:
  NewProcessName|endswith:
    - \rundll32.exe
    - \powershell.exe
  CommandLine|contains|all:
    - rundll32.exe
    - comsvcs.dll

Stage 2: `selection_sysmon_baseline`

selection_sysmon_baseline:
  Image|endswith:
    - \rundll32.exe
    - \powershell.exe
    - \pwsh.exe
    - \powershell_ise.exe

Stage 3: `selection_sysmon_parent_process`

selection_sysmon_parent_process:
  ParentCommandLine:
    - rundll32.exe
    - comsvcs.dll

Stage 4: `selection_sysmon_process`

selection_sysmon_process:
  CommandLine|contains|all:
    - rundll32.exe
    - comsvcs.dll

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`comsvcs.dll` corpus 3 (sigma 2, splunk 1) `rundll32.exe` corpus 8 (sigma 8)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\powershell.exe` corpus 179 (sigma 178, kusto 1) `\powershell_ise.exe` corpus 41 (sigma 41) `\pwsh.exe` corpus 165 (sigma 164, kusto 1) `\rundll32.exe` corpus 94 (sigma 94)	`field:"Image" kind:ends_with`
`NewProcessName`	ends_with	`\powershell.exe` corpus 179 (sigma 178, kusto 1) `\rundll32.exe` corpus 94 (sigma 94)	`field:"Image" kind:ends_with`
`ParentCommandLine`	eq	`comsvcs.dll` `rundll32.exe`	`field:"ParentCommandLine" kind:eq`

LSASS credential dump with LSASSY (process)

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_process_native

Stage 2: selection_sysmon_baseline

Stage 3: selection_sysmon_parent_process

Stage 4: selection_sysmon_process

Indicators

Stage 0: `condition`

Stage 1: `selection_process_native`

Stage 2: `selection_sysmon_baseline`

Stage 3: `selection_sysmon_parent_process`

Stage 4: `selection_sysmon_process`