Detection: Windows Possible Credential Dumping

Description

The following analytic detects possible credential dumping by identifying suspicious process access to LSASS with credential-dumping-related call traces. It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_DUP_HANDLE (0x40).

Search

 1`sysmon`
 2EventCode=10
 3TargetImage=*\\lsass.exe
 4CallTrace IN (
 5    "*dbgcore.dll*",
 6    "*dbghelp.dll*",
 7    "*kernel32.dll*",
 8    "*kernelbase.dll*",
 9    "*ntdll.dll*"
10)
11NOT SourceUser IN (
12    "NT AUTHORITY\\SYSTEM",
13    "NT AUTHORITY\\NETWORK SERVICE"
14)

We looking for a value of PROCESS_QUERY_LIMITED_INFORMATION (0x1000) or PROCESS_DUP_HANDLE (0x40).

 1
 2| eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16)
 3
 4| eval PROCESS_QUERY_LIMITED_INFORMATION = 4096
 5
 6| eval PROCESS_DUP_HANDLE = 64
 7
 8| eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION)
 9
10| eval duplicate_handle_set = bit_and(g_access_decimal, PROCESS_DUP_HANDLE)
11
12| where query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION
13  OR duplicate_handle_set == PROCESS_DUP_HANDLE
14
15
16| stats count min(_time) as firstTime
17                max(_time) as lastTime
18    BY user_id dest
19       signature_id signature granted_access Opcode
20       SourceImage SourceProcessGUID SourceProcessId
21       TargetImage TargetProcessGUID TargetProcessId
22       CallTrace vendor_product
23
24
25| eval CallTrace=split(CallTrace, "
26|")
27
28
29| `security_content_ctime(firstTime)`
30
31| `security_content_ctime(lastTime)`
32
33| `windows_possible_credential_dumping_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 10	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.

Known False Positives

False positives will occur when legitimate tools request query-limited or duplicate-handle access to LSASS. Filter based on source image as needed. Cobalt Strike usage of Mimikatz may generate this activity.

Associated Analytic Story

• Credential Dumping

• DarkSide Ransomware

• CISA AA22-257A

• CISA AA22-264A

• Scattered Lapsus$ Hunters

• Detect Zerologon Attack

• CISA AA23-347A

Intermediate Findings

Threat Objects

References

• https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump

• https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/Windows/TestHarnesses/T1003.001_DumpLSASS/DumpLSASS.ps1

• https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1

• https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html

• https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service

• https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights?redirectedfrom=MSDN

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 15