Detection rules › Splunk
Task Manager lsass Dump (Windows Event Log)
The Windows Task Manager may be used to dump the memory space of lsass.exe to disk for processing with a credential access tool such as Mimikatz. This is performed by launching Task Manager as a privileged user, selecting lsass.exe, and clicking “Create dump file”. This saves a dump file to disk with a deterministic name that includes the name of the process being dumped
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1003.001 OS Credential Dumping: LSASS Memory |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4656 | A handle to an object was requested. |
| Security-Auditing | Event ID 4663 | An attempt was made to access an object. |
| Security-Auditing | Event ID 4673 | A privileged service was called. |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '5477.5647'
title: Task Manager lsass Dump
description: 'The Windows Task Manager may be used to dump the memory space of lsass.exe
to disk for processing with a credential access tool such as Mimikatz. This is performed
by launching Task Manager as a privileged user, selecting lsass.exe, and clicking
“Create dump file”. This saves a dump file to disk with a deterministic name that
includes the name of the process being dumped. - Threat Actor Association: APT29/Nobelium,
UNC2465, UNC5221, UTA0178 - Software Association: Blackcat/ALPHV, Lockbit, Play,
PYSA/Mespinoza, Rhysida, SmokedHAM - Atomics T1003.001 Test #5'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (taskmgr.exe AND lsass.exe
AND (TERM(EventCode=4663) OR "<EventID>4663<" OR TERM(EventCode=4656) OR "<EventID>4656<")
AND TERM(Read) AND TERM(from) AND TERM(Process) AND TERM(memory)) OR (taskmgr.exe
AND (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)) OR (TERM(EventCode=4673)
OR "<EventID>4673<" AND "lsass.exe") | table _time, host, user signature_id, user,
process_id, process_name, process_path, process, parent_process_id, parent_process_name,
parent_process_path | bin span=5s | stats values(*) as * by _time, host | where
mvcount(signature_id)>1 '
techniques:
- credential-access:os credential dumping:lsass memory
technique_id:
- T1003.001
data_category:
- Windows event logs
references:
- https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (taskmgr.exe AND lsass.exe AND (TERM(EventCode=4663) OR "<EventID>4663<" OR TERM(EventCode=4656) OR "<EventID>4656<") AND TERM(Read) AND TERM(from) AND TERM(Process) AND TERM(memory)) OR (taskmgr.exe AND (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process)) OR (TERM(EventCode=4673) OR "<EventID>4673<" AND "lsass.exe")
Stage 2: table
| table _time, host, user signature_id, user, process_id, process_name, process_path, process, parent_process_id, parent_process_name, parent_process_path
Stage 3: bucket
| bin span=5s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: where
| where mvcount(signature_id)>1
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | taskmgr.exe |
| 1 | lsass.exe |
| 1 | TERM |
| 1 | "<EventID>4663<" |
| 1 | TERM |
| 1 | "<EventID>4656<" |
| 1 | TERM |
| 1 | Read |
| 1 | TERM |
| 1 | from |
| 1 | TERM |
| 1 | Process |
| 1 | TERM |
| 1 | memory |
| 1 | taskmgr.exe |
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | TERM |
| 1 | "<EventID>4673<" |
| 1 | "lsass.exe" |