splApache-2.0from splunk/security_content

Dump LSASS via procdump

The following analytic detects the use of procdump.exe to dump the LSASS process, specifically looking for the -mm and -ma command-line arguments. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line executions, and parent processes. This activity is significant because dumping LSASS can expose sensitive credentials, posing a severe security risk. If confirmed malicious, an attacker could obtain credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and further compromise of the environment.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/dump_lsass_via_procdump.yml

| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

from datamodel=Endpoint.Processes where

(
  Processes.process_name IN (
    "procdump.exe",
    "procdump64.exe",
    "procdump64a.exe"
  )
  OR
  Processes.original_file_name=procdump
)
Processes.process IN (
    "*-ma*",
    "*-mm*",
    "*-mp*",
    "*/ma*",
    "*/mm*",
    "*/mp*"
)
Processes.process IN (
    "* keyiso*",
    "* ls*",
    "* samss*"
)

by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
   Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
   Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec
   Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level
   Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product

| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `dump_lsass_via_procdump_filter`