Detection rules › Splunk
Command Line lsass request (Sysmon)
The memory of lsass.exe is often dumped for credential theft attacks. This use case looks for instances of when lsass.exe has been called by powershell.exe or cmd.exe
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '6088.18331'
title: Command Line lsass request
description: 'The memory of lsass.exe is often dumped for credential theft attacks.
This use case looks for instances of when lsass.exe has been called by powershell.exe
or cmd.exe -- Threat Actor Association: Alloy Taurus/Gallium, Cadet Blizzard, Flax
Typhoon, Redfly, Witchetty - Software Association: Blackcat/ALPHV, Clop, Quantum,
Vice Society -- Atomics T1003.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` TERM(lsass) (TERM(cmd) OR TERM(powershell))
| table _time, host, user parent_*, process, process_*, signature_id | bin span=5s
| stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping
technique_id:
- T1003
data_category:
- Windows Sysmon
references:
- https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` TERM(lsass) (TERM(cmd) OR TERM(powershell))
Stage 2: table
| table _time, host, user parent_*, process, process_*, signature_id
Stage 3: bucket
| bin span=5s
Stage 4: stats
| stats values(*) as * by _time, host
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | lsass |
| 1 | cmd |
| 1 | powershell |