detection.wiki

Detection rules › Splunk

Common LSASS Memory Dump Behavior (Windows Event Log)

Group by
_time, host, process_name
Source
github.com/anvilogic-forge/armory

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). This use case looks for behaviors from common tools such as mimikatz, ATPminidump, Dumpert, and CreateMiniDump. -- Threat Actor association: Alloy Taurus/Gallium, APT29/Nobelium, BlackCat, Cadet Blizzard, Carbanak, FIN6, FIN7, FIN12, Flax Typhoon, Lancefly, MalKamak, Phosphorus/Magic Hound/APT35, TA505, TA551, Traveling Spider, UNC2628, Volt Typhoon, Wizard Spider -- Software association: Bazar, BianLian, Blackcat/ALPHV, Clop, Conti, IcedID, GhostShell, Hafnium, Hive, Nefilim, Play, Sodinokibi/REvil, Quantum, Trigona, Trickbot, XingLocker

MITRE ATT&CK coverage

TacticTechniques
Credential Access

References

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 4656: A handle to an object was requested.
Security-AuditingEvent ID 4688: A new process has been created.
Security-AuditingEvent ID 4703: A user right was adjusted.

Rule body

id: '6001.6380'
title: Common LSASS Memory Dump Behavior
description: 'Adversaries may attempt to access credential material stored in the
  process memory of the Local Security Authority Subsystem Service (LSASS). This use
  case looks for behaviors from common tools such as mimikatz, ATPminidump, Dumpert,
  and CreateMiniDump. -- Threat Actor association: Alloy Taurus/Gallium, APT29/Nobelium,
  BlackCat, Cadet Blizzard, Carbanak, FIN6, FIN7, FIN12, Flax Typhoon, Lancefly, MalKamak,
  Phosphorus/Magic Hound/APT35, TA505, TA551, Traveling Spider, UNC2628, Volt Typhoon,
  Wizard Spider -- Software association: Bazar, BianLian, Blackcat/ALPHV, Clop, Conti,
  IcedID, GhostShell, Hafnium, Hive, Nefilim, Play, Sodinokibi/REvil, Quantum, Trigona,
  Trickbot, XingLocker -- Atomics T1003.001 Test #4 Atomics T1003.001 Test #7 Atomics
  T1003.001 Test #8 Atomics T1003.001 Test #11 Atomics T1003.001 Test #12 Atomics
  T1003.004 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "exe") OR ((TERM(EventCode=4656) OR "<EventID>4656<")
  "lsass.exe") OR ((TERM(EventCode=4703) OR "<EventID>4703<") "exe") | regex user!="\$"|
  regex process_name!="(?i)(system32|syswow64)"| table _time, host, user parent_*,
  process, process_*, signature_id | bin span=5s | stats values(*) as * by _time,
  host, process_name | where event_count < 5 AND (match(signature_id, "4688") and
  match(signature_id, "4656")) OR (match(signature_id, "4688") and match(signature_id,
  "4703")) '
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows event logs
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) "exe") OR ((TERM(EventCode=4656) OR "<EventID>4656<") "lsass.exe") OR ((TERM(EventCode=4703) OR "<EventID>4703<") "exe")

Stage 2: regex

| regex user!="\$"

Stage 3: regex

| regex process_name!="(?i)(system32|syswow64)"

Stage 4: table

| table _time, host, user parent_*, process, process_*, signature_id

Stage 5: bucket

| bin span=5s

Stage 6: stats

| stats values(*) as * by _time, host, process_name

Stage 7: where

| where event_count < 5 AND (match(signature_id, "4688") and match(signature_id, "4656")) OR (match(signature_id, "4688") and match(signature_id, "4703"))

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
userregex_match"$"excludes:user
process_nameregex_match"(?i)(system32|syswow64)"excludes:process_name

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventCodeeq
  • 4656 corpus 19 (splunk 15, kusto 4)
  • 4688 corpus 317 (splunk 283, kusto 33, elastic 1)
  • 4703 corpus 2 (splunk 2)
field:"EventID" kind:eq
event_countlt
  • 5 corpus 3 (splunk 3)
field:"event_count" kind:lt value:"5"
signature_idregex_match
  • "4656" corpus 3 (splunk 3)
  • "4688" corpus 8 (splunk 8)
  • "4703"
field:"signature_id" kind:regex_match

Search terms

These SPL tokens match against raw event text.

StageTerm
1"<EventID>4688<"
1"exe"
1"<EventID>4656<"
1"lsass.exe"
1"<EventID>4703<"
1"exe"