LSASS process dump by a non system account

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker will dump the LSASS memory content using tools like Mimikatz, ProcDump, TaskMgr, ...

Known false positives

Antivirus, security products, browsers

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4656: A handle to an object was requested.
Security-Auditing	Event ID 4663: An attempt was made to access an object.

Rule body

title: LSASS process dump by a non system account
description: Detects scenarios where an attacker will dump the LSASS memory content using tools like Mimikatz, ProcDump, TaskMgr, ...
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
tags:
- attack.credential_access
- attack.t1003.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4656 # A handle to an object was requested. / Kernel object
      - 4663 # An attempt was made to access an object / Kernel object
    ObjectType: Process
    ObjectServer: Security
    ObjectName|endswith: '\System32\lsass.exe'
    # AccessMask:
      #- '0x1410'
      #- '0x1010'
      #- '0x1438' # could refers to misc::memssp
      #- '0x143a'
      #- '0x1418'
  filter:
    SubjectUserName|endswith: '$'
    ProcessName:
      - '*\\AppData\Local\Google\Chrome\User Data\SwReporter\\*\software_reporter_tool.exe' # Google Chrome Security tool
      - '*\ProgramData\Microsoft\Windows Defender\Platform\*'
      - '*\Program Files\Windows Defender Advanced Threat Protection\*'
      - '*\system32\csrss.exe'
      - '*\system32\wininit.exe'
      - '*\Windows\System32\rundll32.exe' # See LSASSY dedicated rule
  condition: selection and not filter
falsepositives:
- Antivirus, security products, browsers
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID:
    - 4656
    - 4663
  ObjectType: Process
  ObjectServer: Security
  ObjectName|endswith: '\System32\lsass.exe'

Stage 2: `not filter`

filter:
  SubjectUserName|endswith: '$'
  ProcessName:
    - '*\\AppData\Local\Google\Chrome\User Data\SwReporter\\*\software_reporter_tool.exe'
    - '*\ProgramData\Microsoft\Windows Defender\Platform\*'
    - '*\Program Files\Windows Defender Advanced Threat Protection\*'
    - '*\system32\csrss.exe'
    - '*\system32\wininit.exe'
    - '*\Windows\System32\rundll32.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ProcessName`	ends_with	`\Windows\System32\rundll32.exe`	`excludes:ProcessName` `field:"ProcessName" value:"\Windows\System32\rundll32.exe"`
`ProcessName`	ends_with	`\system32\csrss.exe`	`excludes:ProcessName` `field:"ProcessName" value:"\system32\csrss.exe"`
`ProcessName`	ends_with	`\system32\wininit.exe`	`excludes:ProcessName` `field:"ProcessName" value:"\system32\wininit.exe"`
`ProcessName`	match	`\Program Files\Windows Defender Advanced Threat Protection\`	`excludes:ProcessName` `field:"ProcessName" value:"\Program Files\Windows Defender Advanced Threat Protection\"`
`ProcessName`	match	`\ProgramData\Microsoft\Windows Defender\Platform\`	`excludes:ProcessName` `field:"ProcessName" value:"\ProgramData\Microsoft\Windows Defender\Platform\"`
`ProcessName`	wildcard	`\\AppData\Local\Google\Chrome\User Data\SwReporter\\\software_reporter_tool.exe`	`excludes:ProcessName` `field:"ProcessName" value:"\\AppData\Local\Google\Chrome\User Data\SwReporter\\\software_reporter_tool.exe"`
`SubjectUserName`	ends_with	`$`	`excludes:SubjectUserName` `field:"SubjectUserName" value:"$"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectName`	ends_with	`\System32\lsass.exe`	`field:"ObjectName" kind:ends_with value:"\System32\lsass.exe"`
`ObjectServer`	eq	`Security` corpus 5 (sigma 5)	`field:"ObjectServer" kind:eq value:"Security"`
`ObjectType`	eq	`Process` corpus 4 (sigma 3, elastic 1)	`field:"ObjectType" kind:eq value:"Process"`