detection.wiki

Detection rules › Sigma

Password Dumper Activity on LSASS

Status
test
Severity
high
Log source
product windows, service security
Author
sigma
Source
github.com/SigmaHQ/sigma

Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN

MITRE ATT&CK coverage

TacticTechniques
Credential Access

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 4656: A handle to an object was requested.

Rule body

title: Password Dumper Activity on LSASS
id: aa1697b7-d611-4f9a-9cb2-5125b4ccfd5c
status: test
description: Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN
references:
    - https://twitter.com/jackcr/status/807385668833968128
author: sigma
date: 2017-02-12
modified: 2022-10-09
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4656
        ProcessName|endswith: '\lsass.exe'
        AccessMask: '0x705'
        ObjectType: 'SAM_DOMAIN'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    EventID: 4656
    ProcessName|endswith: '\lsass.exe'
    AccessMask: '0x705'
    ObjectType: 'SAM_DOMAIN'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
AccessMaskeq
  • 0x705
field:"AccessMask" kind:eq value:"0x705"
ObjectTypeeq
  • SAM_DOMAIN corpus 3 (sigma 3)
field:"ObjectType" kind:eq value:"SAM_DOMAIN"
ProcessNameends_with
  • \lsass.exe corpus 7 (sigma 7)
field:"process_name" kind:ends_with value:"\lsass.exe"