Detection rules › Sigma
Task Manager used for LSASS dump (kernel)
Detects scenarios where an attacker attempt to dump the LSASS process via the Task Manager.
Known false positives
- None
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4663: An attempt was made to access an object. |
Rule body
title: Task Manager used for LSASS dump (kernel)
description: Detects scenarios where an attacker attempt to dump the LSASS process via the Task Manager.
references:
- https://superuser.com/questions/753556/taskmgr-exe-called-with-an-argument-by-windows-7
- https://twitter.com/Cyb3rSn0rlax/status/1462900723402817538?t=oMj76JVcPG72ZIlpVxucPw&s=09
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
tags:
- attack.credential_access
- attack.t1003.001 # Credential dumping: LSASS
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4663 # Kernel object
ProcessName|endswith: '\taskmgr.exe'
ObjectName|endswith: '\lsass.exe'
condition: selection
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 4663
ProcessName|endswith: '\taskmgr.exe'
ObjectName|endswith: '\lsass.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ObjectName | ends_with |
| field:"ObjectName" kind:ends_with value:"\lsass.exe" |
ProcessName | ends_with |
| field:"process_name" kind:ends_with value:"\taskmgr.exe" |