detection.wiki

Detection rules › Sigma

Task Manager used for LSASS dump (kernel)

Status
experimental
Severity
high
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempt to dump the LSASS process via the Task Manager.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.001 OS Credential Dumping: LSASS Memory

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 4663An attempt was made to access an object.

Rule body yaml

title: Task Manager used for LSASS dump (kernel)
description: Detects scenarios where an attacker attempt to dump the LSASS process via the Task Manager.
references:
- https://superuser.com/questions/753556/taskmgr-exe-called-with-an-argument-by-windows-7
- https://twitter.com/Cyb3rSn0rlax/status/1462900723402817538?t=oMj76JVcPG72ZIlpVxucPw&s=09
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
tags:
- attack.credential_access
- attack.t1003.001 # Credential dumping: LSASS
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4663 # Kernel object
    ProcessName|endswith: '\taskmgr.exe'
    ObjectName|endswith: '\lsass.exe'
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 4663
  ProcessName|endswith: '\taskmgr.exe'
  ObjectName|endswith: '\lsass.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ObjectNameends_with
  • \lsass.exe corpus 4 (sigma 4)
ProcessNameends_with
  • \taskmgr.exe