Task Manager access indicator for potential LSASS dump

Status: experimental
Severity: low
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.

Known false positives

User accessing the Task Manager

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Task Manager access indicator for potential LSASS dump
description: Provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://superuser.com/questions/753556/taskmgr-exe-called-with-an-argument-by-windows-7
- https://twitter.com/Cyb3rSn0rlax/status/1462900723402817538?t=oMj76JVcPG72ZIlpVxucPw&s=09
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
- https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/
tags:
- attack.credential_access
- attack.t1003.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    NewProcessName|endswith: '\Taskmgr.exe'
    CommandLine|contains:
      - /4 # Right click on Taskbar + Task Manager
      - /3 # Ctrl + Alt + Del + Click on Task Manager
      - /2 # Ctrl + Shift + Escape
      - /1 # Start a non-elevated Task Manager + click "Show processes from all users" button
  condition: selection
falsepositives:
- User accessing the Task Manager
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  NewProcessName|endswith: '\Taskmgr.exe'
  CommandLine|contains:
    - /4
    - /3
    - /2
    - /1

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/1` `/2` `/3` `/4`	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\Taskmgr.exe` corpus 5 (sigma 5)	`field:"Image" kind:ends_with value:"\Taskmgr.exe"`