Credential Dumping via Windows Task Manager
Hypothesis and description
The Windows Task Manager may be used to dump the memory space of lsass.exe to disk for processing with a credential access tool such as Mimikatz. This is performed by launching Task Manager as a privileged user, selecting lsass.exe, and clicking "Create dump file". This saves a dump file to disk with a deterministic name that includes the name of the process being dumped.
This requires filesystem data to determine whether files have been created.
- Platforms
- Windows
- Domain
- Host
- Subtypes
- File
- Submitted
- 2019-08-05
- Contributors
- Tony Lambert/Red Canary
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1003 OS Credential DumpingT1003.001 | Credential Access | Low |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
This base pseudocode looks for file create events where a file with a name similar to lsass.dmp is created by the Windows task manager process.
files = search File:Create
lsass_dump = filter files where (
file_name = "lsass*.dmp" and
image_path = "C:\Windows\*\taskmgr.exe")
output lsass_dumpA Splunk/Sysmon version of the above pseudocode.
index=__your_sysmon_index__ EventCode=11 TargetFilename="*lsass*.dmp" Image="C:\\Windows\\*\\taskmgr.exe"An EQL version of the above pseudocode.
file where file_name == "lsass*.dmp" and process_name == "taskmgr.exe"LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=11 file="*lsass*.dmp" source_image="C:\Windows\*\taskmgr.exe"Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ANAAAdministrative Network Activity Analysis1 shared
- D3-WSAMWeb Session Access Mediation1 shared
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-SFASystem File Analysis1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
- D3-HSHost Shutdown1 shared
- D3-KBPIKernel-based Process Isolation1 shared
- D3-PLAProcess Lineage Analysis1 shared
- D3-PSMDProcess Self-Modification Detection1 shared
- D3-PSProcess Suspension1 shared