Detection rules › Splunk
LSASS Handle request (Windows Event Log)
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). This use case looks for lsass handle calls, without requiring process execution events as an additional identifier in order to detect those executions which may have been injected into a process
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1003.001 OS Credential Dumping: LSASS Memory |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4656 | A handle to an object was requested. |
Rule body yaml
id: '6130.6618'
title: LSASS Handle request
description: 'Adversaries may attempt to access credential material stored in the
process memory of the Local Security Authority Subsystem Service (LSASS). This use
case looks for lsass handle calls, without requiring process execution events as
an additional identifier in order to detect those executions which may have been
injected into a process. -- Software Association: Quantum -- Atomics T1003.002 Test
#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4656) OR
"<EventID>4656<") "lsass.exe" TERM(Read) TERM(from) TERM(process) TERM(memory))
| eval Source_Process_ID=if(like(Source_Process_ID,"%x%"),tonumber(Source_Process_ID,16),Source_Process_ID)|
eval process_id=mvappend(process_id, Source_Process_ID) | table _time, host, user
signature_id, user, process_* | bin span=6s | stats values(*) as * by _time, host,
user | eventstats c(process_name) as c_process by process_name| where c_process
< 50 and event_count < 10 '
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows event logs
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4656) OR "<EventID>4656<") "lsass.exe" TERM(Read) TERM(from) TERM(process) TERM(memory))
Stage 2: eval
| eval Source_Process_ID=if(like(Source_Process_ID,"%x%"),tonumber(Source_Process_ID,16),Source_Process_ID)
Stage 3: eval
| eval process_id=mvappend(process_id, Source_Process_ID)
Stage 4: table
| table _time, host, user signature_id, user, process_*
Stage 5: bucket
| bin span=6s
Stage 6: stats
| stats values(*) as * by _time, host, user
Stage 7: eventstats
| eventstats c(process_name) as c_process by process_name
Stage 8: where
| where c_process < 50 and event_count < 10
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
c_process | lt |
|
event_count | lt |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4656<" |
| 1 | "lsass.exe" |
| 1 | TERM |
| 1 | Read |
| 1 | TERM |
| 1 | from |
| 1 | TERM |
| 1 | process |
| 1 | TERM |
| 1 | memory |