detection.wiki

Detection rules › Sigma

LSASS credential dump with LSASSY (admin share)

Status
experimental
Severity
high
Log source
product Windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.

Known false positives

  • none

MITRE ATT&CK coverage

TacticTechniques
Credential Access

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: LSASS credential dump with LSASSY (admin share)
description: Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://github.com/Hackndo/lsassy
tags:
- attack.credential_access
- attack.t1003.001
author: mdecrevoisier
status: experimental
logsource:
  product: Windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\\*\C$'
    RelativeTargetName|startswith: Windows # path can be changed in source code
    RelativeTargetName|endswith: '.dmp'    # example: 'Windows\Temp\FbWJpFnX.dmp'. Extension can be changed in source code
  condition: selection
falsepositives:
- none
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 5145
  ShareName: '\\*\C$'
  RelativeTargetName|startswith: Windows
  RelativeTargetName|endswith: '.dmp'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
RelativeTargetNameends_with
  • .dmp corpus 2 (sigma 2)
field:"RelativeTargetName" kind:ends_with value:".dmp"
RelativeTargetNamestarts_with
  • Windows
field:"RelativeTargetName" kind:starts_with value:"Windows"
ShareNamewildcard
  • \\*\C$ corpus 7 (sigma 7)
field:"ShareName" kind:wildcard value:"\\*\C$"