MaxPatrol SIEM knowledge base

Monitor executed commands and arguments that may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module, which may require additional logging features to be configured in the operating system to collect necessary information for analysis.

Note: Event ID 4104 from the “Microsoft-Windows-PowerShell/Operational” log captures Powershell script blocks, whose contents can be further analyzed to determine if they’re performing LSASS dumping.

Monitor for changes to Registry entries associated with credential access that is stored in the process memory of the LSASS. For example, the adversary can modify the SAM and SYSTEM files.

Monitor for newly constructed logon behavior from credentials being accessed by process memory of the LSASS. For example, detect behaviors of Secretsdump against a system, not being a Domain Controller.

Monitor for the unexpected creation of memory dump files for the LSASS process (e.g., lsass{*}.dmp).

Monitor for API calls that may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). OS API calls associated with LSASS process dumping include OpenProcess and MiniDumpWriteDump. Execution of these functions might trigger security log ids such as 4663 (Microsoft Security Auditing) and 10 (Microsoft Sysmon)

Note: Most EDR tools do not support direct monitoring of API calls due to the sheer volume of calls produced by an endpoint but may have alerts or events that are based on abstractions of OS API calls. Dynamic malware analysis tools (i.e., sandboxes) can be used to trace the execution, including OS API calls, for a single PE binary.

Monitor for newly executed processes that may be indicative of credential dumping. On Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process. Try monitoring for Sysmon Event ID 1 and/or Windows Security Event ID 4688 for process activity.

Note:

• Rundll32/MiniDump has a different command-line syntax than that of Procdump, in that the process being dumped is specified via process ID instead of name (as with Procdump). Therefore, because the LSASS process ID is non-deterministic, the MiniDump detection isn’t specific to LSASS dumping and may need to be tuned to help reduce false positives.
• When monitoring for .dll functions on the command-line be sure to also check for the ordinal associated with the function.

Analytic 1 - Procdump

(source=WinEventLog:"*Security" EventCode="4688") OR (source=WinEventLog:"*Microsoft-Windows-Sysmon/Operational" EventCode="1") AND Image="procdump*.exe" | where CommandLine LIKE "%lsass%"

Analytic 2 - MiniDump via rundll32

(source=WinEventLog:"*Security" EventCode="4688") OR (source=WinEventLog:"*Microsoft-Windows-Sysmon/Operational" EventCode="1") AND Image="\*rundll32.exe" | where CommandLine LIKE "%comsvcs.dll MiniDump%" OR CommandLine="_comsvcs.dll,#24")

Monitor for unexpected processes interacting with LSASS.exe. Common credential dumpers such as Mimikatz access LSASS.exe by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective Process Injection to reduce potential indicators of malicious activity.

Usage of Procdump and Windows Task Manager for LSASS dumping can also be detected via process creation events, since they both have a predictable set of command-line arguments (i.e., for specifying the process to be dumped).

Note: Sysmon process access events (Event ID 10) can be extremely noisy, which necessitates tweaking the Sysmon configuration file. We recommend taking an approach analogous to that of the Sysmon Modular Configuration project (https://github.com/olafhartong/sysmon-modular) and filtering out any benign processes in your environment that produce large volumes of process access events.

The GrantedAccess value in the below analytic for Mimikatz is meant to be used solely as an illustrative example of detecting Mimikatz LSASS access. However, actual GrantedAccess values change over time with different versions of Mimikatz and therefore detection engineers need to verify the accuracy of any GrantedAccess values that their analytics are using.

Analytic 1 - Mimikatz

(source=WinEventLog:"Microsoft-Windows-Sysmon/Operational" EventCode="10" AND TargetImage= "lsass.exe" AND (GrantedAccess=0x1410 OR GrantedAccess=0x1010 OR GrantedAccess=0x1438 OR GrantedAccess=0x143a OR GrantedAccess=0x1418) CallTrace="C:\windows\SYSTEM32\ntdll.dll+|C:\windows\System32\KERNELBASE.dll+20edd|UNKNOWN()")

Analytic 2 - Procdump

((sourceType=WinEventLog:"*Microsoft-Windows-Sysmon/Operational" EventCode="10") AND TargetImage= "*lsass.exe" AND SourceImage= "*procdump.exe")

Analytic 3 - Windows Task Manager

((sourceType=WinEventLog:"*Microsoft-Windows-Sysmon/Operational" EventCode="10") AND TargetImage="*lsass.exe" AND SourceImage= "c:\windows*\taskmgr.exe")

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.

Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

Consider disabling or restricting NTLM. Consider disabling WDigest authentication.

On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing.

With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. It also does not protect against all forms of credential dumping.