Detection rules › Splunk
Command Line lsass request (Windows Event Log)
The memory of lsass.exe is often dumped for credential theft attacks. This use case looks for instances of when lsass.exe has been called by powershell.exe or cmd.exe
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1003 OS Credential Dumping |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '6088.6537'
title: Command Line lsass request
description: 'The memory of lsass.exe is often dumped for credential theft attacks.
This use case looks for instances of when lsass.exe has been called by powershell.exe
or cmd.exe -- Threat Actor Association: Alloy Taurus/Gallium, Cadet Blizzard, Flax
Typhoon, Redfly, Witchetty - Software Association: Blackcat/ALPHV, Clop, Quantum,
Vice Society -- Atomics T1003.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(lsass) (TERM(cmd) OR
TERM(powershell)) | table _time, host, user parent_*, process, process_*, signature_id
| bin span=5s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping
technique_id:
- T1003
data_category:
- Windows event logs
references:
- https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` TERM(lsass) (TERM(cmd) OR TERM(powershell))
Stage 2: table
| table _time, host, user parent_*, process, process_*, signature_id
Stage 3: bucket
| bin span=5s
Stage 4: stats
| stats values(*) as * by _time, host
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | lsass |
| 1 | TERM |
| 1 | cmd |
| 1 | TERM |
| 1 | powershell |