MiniDump of LSASS
Hypothesis and description
This analytic detects the minidump variant of credential dumping where a process opens lsass.exe in order to extract credentials using the Win32 API call MiniDumpWriteDump. Tools like SafetyKatz, SafetyDump, and Outflank-Dumpert default to this variant and may be detected by this analytic, though keep in mind that not all options for using those tools will result in this specific behavior.
The analytic is based on a Sigma analytic contributed by Samir Bousseaden and written up in a blog on MENASEC. It looks for a call trace that includes either dbghelp.dll or dbgcore.dll, which export the relevant functions/permissions to perform the dump. It also detects using the Windows Task Manager (taskmgr.exe) to dump lsass, which is described in CAR-2019-08-001. In this iteration of the Sigma analytic, the GrantedAccess filter isn't included because it didn't seem to filter out any false positives and introduces the potential for evasion.
This analytic was tested both in a lab and in a production environment with a very low false-positive rate. werfault.exe and tasklist.exe, both standard Windows processes, showed up multiple times as false positives.
NOTE - this analytic has no corresponding pseudocode implementation because the CAR data model doesn't currently support process access events.
- Platforms
- Windows
- Domain
- Host
- Subtypes
- Process
- Submitted
- 2020-05-04
- Contributors
- Cyber National Mission Force (CNMF)
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1003 OS Credential DumpingT1003.003 | Credential Access | Low |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Pseudocode and implementations
This Splunk query looks for process access events where lsass.exe is accessed with a specific call trace that indicates the use of MiniDumpWriteDump.
index=__your_sysmon_index__ EventCode=10 TargetImage="C:\\windows\\system32\\lsass.exe" (CallTrace="*dbghelp.dll*" OR CallTrace="*dbgcore.dll*")| table _time host SourceProcessId SourceImageLogPoint version of the above pseudocodes.
norm_id=WindowsSysmon event_id=10 image="C:\Windows\system32\lsass.exe" call_trace IN ["*dbghelp.dll*", "*dbgcore.dll*"]
| fields log_ts host source_process_id source_imageAcross MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ANAAAdministrative Network Activity Analysis1 shared
- D3-WSAMWeb Session Access Mediation1 shared
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-SFASystem File Analysis1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
- D3-HSHost Shutdown1 shared
- D3-KBPIKernel-based Process Isolation1 shared
- D3-PLAProcess Lineage Analysis1 shared
- D3-PSMDProcess Self-Modification Detection1 shared
- D3-PSProcess Suspension1 shared