Detection rules › Splunk

Command Line lsass request (Windows Event Log)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

The memory of lsass.exe is often dumped for credential theft attacks. This use case looks for instances of when lsass.exe has been called by powershell.exe or cmd.exe

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003 OS Credential Dumping

References

Event coverage

Rule body yaml

id: '6088.6537'
title: Command Line lsass request
description: 'The memory of lsass.exe is often dumped for credential theft attacks.
  This use case looks for instances of when lsass.exe has been called by powershell.exe
  or cmd.exe -- Threat Actor Association: Alloy Taurus/Gallium, Cadet Blizzard, Flax
  Typhoon, Redfly, Witchetty - Software Association: Blackcat/ALPHV, Clop, Quantum,
  Vice Society -- Atomics T1003.002 Test #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` TERM(lsass) (TERM(cmd) OR
  TERM(powershell)) | table _time, host, user parent_*, process, process_*, signature_id
  | bin span=5s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping
technique_id: 
- T1003
data_category:
- Windows event logs
references:
- https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` TERM(lsass) (TERM(cmd) OR TERM(powershell))

Stage 2: table

| table _time, host, user parent_*, process, process_*, signature_id

Stage 3: bucket

| bin span=5s

Stage 4: stats

| stats values(*) as * by _time, host

Search terms

Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.

StageTerm
1TERM
1lsass
1TERM
1cmd
1TERM
1powershell