Detection rules › Splunk
ProcDump Credential Harvest (Sysmon)
Mimikatz is largely detected by AntiVirus software.As Procdump is a legitimate Microsoft tool, it's not detected by AntiVirus. The goal is to dump the lsass.exe process, which contains the credentials, and then give this dump to mimikatz.You need Admin rights to use it. Dump the lsass process which contains credentials
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1003.001 OS Credential Dumping: LSASS Memory |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '1083.1127'
title: ProcDump Credential Harvest
description: 'Mimikatz is largely detected by AntiVirus software.As Procdump is a
legitimate Microsoft tool, it''s not detected by AntiVirus. The goal is to dump
the lsass.exe process, which contains the credentials, and then give this dump to
mimikatz.You need Admin rights to use it. Dump the lsass process which contains
credentials. -- Threat Actor Association: Agrius, Alloy Taurus/Gallium, Antlion,
BlackCat, FamousSparrow, FIN12, FIN13, Hydrochasma, Lazarus, MuddyWater, TA551,
Wizard Spider - Software Association: Bazarloader, Conti, Hafnium , IcedID, LockBit,
NetWalker, Rhysida -- Atomics T1003.001 Test #2 Atomics T1003.001 Test #9'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` "procdump" "lsass" | rex field=_raw
max_match=2 "(?<file>[a-zA-Z0-9]+\.dmp") | table _time, host, user, process, parent_process_name,
file| bin span=30s | stats values(*) as * by _time, host | where match(process,
"(?i)procdump") AND match(process, "(?i)lsass") | table _time, host, user process,
parent_process_name, file `hec_collect`'
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1003/001/
- https://github.com/LOLBAS-Project/LOLBAS/pull/182/commits/e14a01bbb5c0b06990cd8f6fc85ee5908ae3da32
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` "procdump" "lsass"
Stage 2: eval
| rex field=_raw max_match=2 "(?<file>[a-zA-Z0-9]+\.dmp")
Stage 3: table
| table _time, host, user, process, parent_process_name, file
Stage 4: bucket
| bin span=30s
Stage 5: stats
| stats values(*) as * by _time, host
Stage 6: where
| where match(process, "(?i)procdump") AND match(process, "(?i)lsass")
Stage 7: table
| table _time, host, user process, parent_process_name, file `hec_collect`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
process | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | "procdump" |
| 1 | "lsass" |