HUNTS- Credential Dumping (T1003)
HUNTS- Credential Dumping (T1003)
Version 1.0
ATT&CK Technique: Credential Dumping (T1003)
What this playbook hunts for:
-
Inter-process access to lsass.exe by a non-standard (non-Windows/non-whitelisted) process. Lsass.exe stores credentials in Windows hosts, making it a target for attackers and malicious software. In hosts running Windows 8 (excluding Windows 8.1) and below, dumping the lsass.exe process can result in the exposure of plain text credentials including passwords and hashes.
How the playbook works:
-
Generates SIEM query for Sysmon Event ID 10 logs where lsass.exe is the target process
-
Enriches query results with a subsequent Sysmon Event ID 1 query that captures detailed process information on the process accessing lsass.exe
What results are expected:
-
Name, process ID, and path of process accessing lsass.exe
-
Lsass.exe access time
-
MD5 hash of the process accessing lsass.exe
-
Hostname of the computer where lsass.exe was accessed
-
User account which launched the process accessing lsass.exe
Common follow-on actions:
-
Enumerate logged on users (identify which credentials were exposed)
-
Detect lateral movement (identify other potentially compromised hosts)
-
Quarantine host
What inputs are necessary:
-
SIEM
-
Logs: Sysmon Event ID 1: Process creation
-
Logs: Sysmon Event ID 10: ProcessAccess
-
Hunt start time
What subroutine playbooks are needed:
-
Create and Link Alerts from Hunt (Host-based)
What configurations are needed:
-
Sysmon logging enabled with the following added to the configuration file under the SYSMON EVENT ID 10 section:
<ProcessAccess onmatch="include">
<TargetImage condition="is">C:\Windows\system32\lsass.exe</TargetImage>
</ProcessAccess>
False Positive Potential: Medium
-
Depending on the environment, many processes may legitimately need to access lsass.exe. It is highly recommended that the previously described Sysmon configuration be tested on a small group of systems before being deployed across the enterprise as a large number of events may be produced.
-
Process accesses that are determined to be false positives should be added to the “excluded” section of the Sysmon configuration to create a whitelist and reduce the number of events generated. Additional filtering can also be added to the initial SIEM query.