Lsass Process Dump via Procdump

Hypothesis and description

ProcDump is a sysinternal command-line utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike.

ProcDump may be used to dump the memory space of lsass.exe to disk for processing with a credential access tool such as Mimikatz. This is performed by launching procdump.exe as a privileged user with command line options indicating that lsass.exe should be dumped to a file with an arbitrary name.

Note - the CAR data model currently does not support process access actions, so the pseudocode implementation is based around process creates.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2019-07-29
Contributors: Kaushal Parikh/Cyware Labs, Tony Lambert/Red Canary, MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1003 OS Credential DumpingT1003.001	Credential Access	Low

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1003OS Credential Dumping
.001 LSASS Memory

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodeProcdump - Process Create

This base pseudocode looks for process create events where an instance of procdump is executed that references lsass in the command-line.

processes = search Process:Create
procdump_lsass = filter processes where (
  exe = "procdump*.exe"  and
  command_line = "*lsass*")
output procdump_lsass

SplunkProcdump - Process CreateData model: Sysmon native

A Splunk/Sysmon version of the above pseudocode.

index=__your_sysmon_index__ EventCode=1 Image="*\\procdump*.exe" CommandLine="*lsass*"

EQLProcdump - Process Create

An EQL Version of the above pseudocode.

MITRE published no code for this implementation.

SplunkProcdump - Process AccessData model: Sysmon native

A related Splunk search, which instead of looking for process create events looks for process access events that target lsass.exe.

index=__your_sysmon_index__ EventCode=10 TargetImage="C:\\WINDOWS\\system32\\lsass.exe" GrantedAccess="0x1FFFFF" ("procdump")

SigmaProcdump - Process Access

A Sigma Version of the above Splunk search, with some more stringent criteria around calltrace.

MITRE published no code for this implementation.

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="*\procdump*.exe" command="*lsass*"

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

36 more in the full list

View CAR-2019-07-002 on car.mitre.org

Hypothesis and description

Note - the CAR data model currently does not support process access actions, so the pseudocode implementation is based around process creates.

Technique

Tactics

Coverage

T1003 OS Credential DumpingT1003.001

Credential Access

Low

Pseudocode and implementations

PseudocodeProcdump - Process Create

This base pseudocode looks for process create events where an instance of procdump is executed that references lsass in the command-line.

processes = search Process:Create
procdump_lsass = filter processes where (
  exe = "procdump*.exe"  and
  command_line = "*lsass*")
output procdump_lsass

SplunkProcdump - Process CreateData model: Sysmon native

A Splunk/Sysmon version of the above pseudocode.

index=__your_sysmon_index__ EventCode=1 Image="*\\procdump*.exe" CommandLine="*lsass*"

EQLProcdump - Process Create

An EQL Version of the above pseudocode.

MITRE published no code for this implementation.

SplunkProcdump - Process AccessData model: Sysmon native

A related Splunk search, which instead of looking for process create events looks for process access events that target lsass.exe.

index=__your_sysmon_index__ EventCode=10 TargetImage="C:\\WINDOWS\\system32\\lsass.exe" GrantedAccess="0x1FFFFF" ("procdump")

SigmaProcdump - Process Access

A Sigma Version of the above Splunk search, with some more stringent criteria around calltrace.

MITRE published no code for this implementation.

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="*\procdump*.exe" command="*lsass*"