LSASS Handle request (Windows Event Log)

id: '6130.6618'
title: LSASS Handle request
description: 'Adversaries may attempt to access credential material stored in the
  process memory of the Local Security Authority Subsystem Service (LSASS). This use
  case looks for lsass handle calls, without requiring process execution events as
  an additional identifier in order to detect those executions which may have been
  injected into a process. -- Software Association: Quantum -- Atomics T1003.002 Test
  #4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4656) OR
  "<EventID>4656<") "lsass.exe" TERM(Read) TERM(from) TERM(process) TERM(memory))
  | eval Source_Process_ID=if(like(Source_Process_ID,"%x%"),tonumber(Source_Process_ID,16),Source_Process_ID)|
  eval process_id=mvappend(process_id, Source_Process_ID) | table _time, host, user
  signature_id, user, process_* | bin span=6s | stats values(*) as * by _time, host,
  user | eventstats c(process_name) as c_process by process_name| where c_process
  < 50 and event_count < 10 '
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows event logs
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass