Create Remote Thread into LSASS
Hypothesis and description
Actors may create a remote thread into the LSASS service as part of a workflow to dump credentials.
- Platforms
- Windows
- Domain
- Analytic
- Subtypes
- Process
- Submitted
- 2021-05-11
- Contributors
- Splunk Threat Research <research@splunk.com>
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1003 OS Credential DumpingT1003.001 | Credential Access | Moderate |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
Pseudocode implementation of the Splunk search below. The CAR data model does not currently contain a Target Image field, for remote thread creation, so this code Is somewhat inexact. See the Splunk implementation for a more precise search for the lsass image target.
remote_threads = search Thread:remote_create
lsass_remote_create = filter remote_threads where "lsass" in raw event
output lsass_remote_createThis search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named sysmon. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId | rename Computer as destAcross MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ANAAAdministrative Network Activity Analysis1 shared
- D3-WSAMWeb Session Access Mediation1 shared
- D3-AEMApplication Exception Monitoring1 shared
- D3-OPMOperational Process Monitoring1 shared
- D3-SFASystem File Analysis1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
- D3-HSHost Shutdown1 shared
- D3-KBPIKernel-based Process Isolation1 shared
- D3-PLAProcess Lineage Analysis1 shared
- D3-PSMDProcess Self-Modification Detection1 shared
- D3-PSProcess Suspension1 shared