Detect Credential Dumping through LSASS access

Name:Detect Credential Dumping through LSASS access
id:2c365e57-4414-4540-8dc0-73ab10729996
version:16
date:None
author:Patrick Bareiss, Splunk
status:production
type:TTP
Description:The following analytic detects attempts to read LSASS memory, indicative of credential dumping. It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe.
Data_source:

• -Sysmon EventID 10

search:`sysmon`
EventCode=10
TargetImage="*\\lsass.exe"

```
Convert GrantedAccess from hexadecimal to decimal.
Match "PROCESS_VM_READ" with either "PROCESS_QUERY_LIMITED_INFORMATION" or "PROCESS_QUERY_INFORMATION", which represent the either the "0x1010" or "0x1410" hexadecimal masks.
```
| eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16)
| eval PROCESS_VM_READ = 16
| eval PROCESS_QUERY_LIMITED_INFORMATION = 4096
| eval PROCESS_QUERY_INFORMATION = 1024
| eval vm_read_set = bit_and(g_access_decimal, PROCESS_VM_READ)
| eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION)
| eval query_information_set = bit_and(g_access_decimal, PROCESS_QUERY_INFORMATION)
| where vm_read_set == PROCESS_VM_READ
AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION
AND (query_information_set == 0 OR query_information_set == PROCESS_QUERY_INFORMATION)

| stats count min(_time) as firstTime
max(_time) as lastTime
BY user_id dest
signature_id signature granted_access Opcode
SourceImage SourceProcessGUID SourceProcessId
TargetImage TargetProcessGUID TargetProcessId
CallTrace vendor_product

| eval CallTrace=split(CallTrace, "|")

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `detect_credential_dumping_through_lsass_access_filter`

how_to_implement:This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
known_false_positives:The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.
References:
  -https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/
  -https://attack.mitre.org/techniques/T1003/001/
drilldown_searches:
 name:'View the detection results for - "$dest$" and "$TargetImage$"'
 search:'%original_detection_search% | search dest = "$dest$" TargetImage = "$TargetImage$"'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
 name:'View risk events for the last 7 days for - "$dest$" and "$TargetImage$"'
 search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$TargetImage$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 earliest_offset:'7d'
 latest_offset:'0'
analytic_story:['Detect Zerologon Attack', 'CISA AA23-347A', 'Credential Dumping', 'BlackSuit Ransomware', 'Lokibot', 'Scattered Lapsus$ Hunters']

asset_type:Windows

mitre_attack_id:['T1003.001']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:endpoint

security_domain:endpoint

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
  sourcetype: XmlWinEventLog
 test_type:'unit'
manual_test:None