MaxPatrol SIEM

Detects cyberincidents that undermine cyber resilience of a company

T1003.001: LSASS Memory

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.

As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.

For example, on the target host use procdump:

  • procdump -ma lsass.exe lsass_dump

Locally, mimikatz can be run using:

  • sekurlsa::Minidump lsassdump.dmp
  • sekurlsa::logonPasswords

Built-in Windows tools such as comsvcs.dll can also be used:

  • rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full

Similar to Image File Execution Options Injection, the silent process exit mechanism can be abused to create a memory dump of lsass.exe through Windows Error Reporting (WerFault.exe).

Windows Security Support Provider (SSP) DLLs are loaded into LSASS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.

The following SSPs can be used to access credentials:

  • Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.
  • Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.
  • Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.
  • CredSSP: Provides SSO and Network Level Authentication for Remote Desktop Services.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

mitre_attck_cred_access: PT-CR-544: LSASS_memory_access_SubRule: An attempt to access the LSASS.exe process data
mitre_attck_cred_access: PT-CR-564: LSASS_Dump_via_TaskManager: A memory dump of the lsass process is generated
mitre_attck_cred_access: PT-CR-565: LSASS_Memory_Dump: A lsass dump is generated
mitre_attck_cred_access: PT-CR-567: ProcDump_Usage: A LSASS dump is generated using ProcDump
hacking_tools: PT-CR-747: Cobalt_Strike_DumpHashes: LSASS dump creation using Cobalt Strike is detected
mitre_attck_cred_access: PT-CR-764: AvDump_LSASS_Dump: Creation of a process memory dump using AvDump is detected
mitre_attck_cred_access: PT-CR-767: Failed_LSASS_Injection: A system reboot caused by lsass.exe is detected
mitre_attck_cred_access: PT-CR-770: Lsass_DLL_Injection: A library was injected into the Local Security Authority Subsystem Service (LSASS) process. After a user logs in, the system creates various credentials and stores them in the LSASS process memory.
hacking_tools: PT-CR-585: Impacket_Secretsdump: Use of Impacket Secretsdump is detected
mitre_attck_cred_access: PT-CR-1077: Failed_DefaultCredentials_Delegation: A failed attempt to use the delegation of default credentials is detected
mitre_attck_cred_access: PT-CR-1078: Kekeo_Credentials_Relay_via_NTLM: Possible use of the kekeo utility to dump credentials is detected
mitre_attck_cred_access: PT-CR-1079: Subrule_NTLM_Logon: The use of the kekeo utility is detected according to two event bundles
mitre_attck_lateral_movement: PT-CR-1372: Remote_SSP_Dump: The use of a script from a modified Impacket toolkit is detected. This allows to remotely dump the lsass process memory.
mitre_attck_cred_access: PT-CR-1074: Create_Remote_Thread_Into_LSASS: A thread is created in the address space of the lsass.exe process
mitre_attck_cred_access: PT-CR-311: Remote_Password_Dump: Remote access to SAMR, WINREG, SVCCTL, and C:\Windows\system32 within 30 seconds of user authentication
mitre_attck_cred_access: PT-CR-771: Lsass_Dump_via_SilentProcessExit: Creation of an lsass.exe process memory dump using SilentProcessExit is detected
mitre_attck_cred_access: PT-CR-772: LSASS_PSSCapture_Snapshot: Creation of an lsass.exe copy is detected
mitre_attck_cred_access: PT-CR-774: MalSecLogon_LSASS_Dump: Creation of an lsass.exe process memory dump using the Seclogon service is detected
mitre_attck_cred_access: PT-CR-775: Physmem2profit_LSASS_Dump: Use of Physmem2profit to create an lsass.exe process memory dump is detected
mitre_attck_cred_access: PT-CR-776: PPLdump_Usage: A suspicious process chain accessed the LSASS process. This may indicate the use of the PPLdump hacker tool.
process_chains_and_logons: PT-CR-912: LSASS_Memory_Dump_via_Migrated_Process: The lsass.exe process memory is dumped via a migrated process
mitre_attck_cred_access: PT-CR-915: Subrule_Lsass_for_DragonCastle: The lsass.exe process loaded a suspicious library and changed a system registry key
mitre_attck_cred_access: PT-CR-917: Subrule_Shares_for_DragonCastle: Consecutive connections to network resources are detected
mitre_attck_execution: PT-CR-954: Tttracer_LOLBin: Bypassing protection with tttracer.exe
hacking_tools: PT-CR-758: Lazagne_Usage: Use of the LaZagne tool to dump credentials is detected
mitre_attck_cred_access: PT-CR-1205: DragonCastle_LSASS_Dump: User key information is extracted via DragonCastle
mitre_attck_cred_access: PT-CR-1206: LSASS_Shtinkering_Dump: Creation of a dump using the WerFault.exe process is detected
mitre_attck_cred_access: PT-CR-1720: PPLFault_Process_Dump: A process was dumped using PPLFault
mitre_attck_cred_access: PT-CR-1766: Subrule_PPLmedic_Svchost: Abnormal file creation by the svchost process
mitre_attck_cred_access: PT-CR-1767: Subrule_PPLmedic_WerFaultSecure: Abnormal file creation by the WerFaultSecure process
mitre_attck_cred_access: PT-CR-1768: PPLmedic_Process_Dump: A process was dumped using PPLmedic
mitre_attck_cred_access: PT-CR-1769: Subrule_PPLmedic_DllLoad: PPLmedic injected a DDL file into a registry
mitre_attck_cred_access: PT-CR-2124: LSASS_Dump_via_RPC: A user accessed the LSASS process memory. After connecting the corresponding utility (such as Mimikatz) to the RPC server and gaining access to the LSASS process memory, attackers can save this memory in a separate file to later extract passwords and NTLM hashes from it.
mitre_attck_defense_evasion: PT-CR-313: WDigest_Enable: WDigest authentication is enabled
mitre_attck_defense_evasion: PT-CR-773: Lsass_SilentProcessExit_Keys: Creation of registry keys for an lsass.exe process memory dump using SIlentProcessExit is detected
mitre_attck_cred_access: PT-CR-2311: Subrule_LOLBins_LSASS_Dump: A legitimate LOLBins process accessed or dumped the LSASS process memory
mitre_attck_cred_access: PT-CR-2313: MultiDump_LSASS_Dump: The MultiDump utility was used for dumping LSASS memory discreetly, without triggering Defender alerts
mitre_attck_cred_access: PT-CR-297: Abusing_CredSSP: The CredSSP settings are modified to use less secure user authentication algorithms
mitre_attck_cred_access: PT-CR-303: Comsvcs_Minidump_Usage: A user dumped the lsass process with comsvcs.dll

Detection

IDDS0009Data source and componentProcess: Process AccessDescription

Monitor for unexpected processes interacting with LSASS.exe. Common credential dumpers such as Mimikatz access LSASS.exe by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored. Credential dumpers may also use methods for reflective Process Injection to reduce potential indicators of malicious activity.

Usage of Procdump and Windows Task Manager for LSASS dumping can also be detected via process creation events, since they both have a predictable set of command-line arguments (i.e., for specifying the process to be dumped).

Note: Sysmon process access events (Event ID 10) can be extremely noisy, which necessitates tweaking the Sysmon configuration file. We recommend taking an approach analogous to that of the Sysmon Modular Configuration project (https://github.com/olafhartong/sysmon-modular) and filtering out any benign processes in your environment that produce large volumes of process access events.

The GrantedAccess value in the below analytic for Mimikatz is meant to be used solely as an illustrative example of detecting Mimikatz LSASS access. However, actual GrantedAccess values change over time with different versions of Mimikatz and therefore detection engineers need to verify the accuracy of any GrantedAccess values that their analytics are using.

Analytic 1 - Mimikatz

(source=WinEventLog:"Microsoft-Windows-Sysmon/Operational" EventCode="10" AND TargetImage= "lsass.exe" AND (GrantedAccess=0x1410 OR GrantedAccess=0x1010 OR GrantedAccess=0x1438 OR GrantedAccess=0x143a OR GrantedAccess=0x1418) CallTrace="C:\windows\SYSTEM32\ntdll.dll+|C:\windows\System32\KERNELBASE.dll+20edd|UNKNOWN()")

Analytic 2 - Procdump

((sourceType=WinEventLog:"*Microsoft-Windows-Sysmon/Operational" EventCode="10") AND TargetImage= "*lsass.exe" AND SourceImage= "*procdump.exe")

Analytic 3 - Windows Task Manager

((sourceType=WinEventLog:"*Microsoft-Windows-Sysmon/Operational" EventCode="10") AND TargetImage="*lsass.exe" AND SourceImage= "c:\windows*\taskmgr.exe")

IDDS0009Data source and componentProcess: Process CreationDescription

Monitor for newly executed processes that may be indicative of credential dumping. On Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process. Try monitoring for Sysmon Event ID 1 and/or Windows Security Event ID 4688 for process activity.

Note:

  • Rundll32/MiniDump has a different command-line syntax than that of Procdump, in that the process being dumped is specified via process ID instead of name (as with Procdump). Therefore, because the LSASS process ID is non-deterministic, the MiniDump detection isn’t specific to LSASS dumping and may need to be tuned to help reduce false positives.
  • When monitoring for .dll functions on the command-line be sure to also check for the ordinal associated with the function.

Analytic 1 - Procdump

(source=WinEventLog:"*Security" EventCode="4688") OR (source=WinEventLog:"*Microsoft-Windows-Sysmon/Operational" EventCode="1") AND Image="procdump*.exe" | where CommandLine LIKE "%lsass%"

Analytic 2 - MiniDump via rundll32

(source=WinEventLog:"*Security" EventCode="4688") OR (source=WinEventLog:"*Microsoft-Windows-Sysmon/Operational" EventCode="1") AND Image="\*rundll32.exe" | where CommandLine LIKE "%comsvcs.dll MiniDump%" OR CommandLine="_comsvcs.dll,#24")

IDDS0028Data source and componentLogon Session: Logon Session CreationDescription

Monitor for newly constructed logon behavior from credentials being accessed by process memory of the LSASS. For example, detect behaviors of Secretsdump against a system, not being a Domain Controller.

IDDS0009Data source and componentProcess: OS API ExecutionDescription

Monitor for API calls that may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). OS API calls associated with LSASS process dumping include OpenProcess and MiniDumpWriteDump. Execution of these functions might trigger security log ids such as 4663 (Microsoft Security Auditing) and 10 (Microsoft Sysmon)

Note: Most EDR tools do not support direct monitoring of API calls due to the sheer volume of calls produced by an endpoint but may have alerts or events that are based on abstractions of OS API calls. Dynamic malware analysis tools (i.e., sandboxes) can be used to trace the execution, including OS API calls, for a single PE binary.

IDDS0024Data source and componentWindows Registry: Windows Registry Key ModificationDescription

Monitor for changes to Registry entries associated with credential access that is stored in the process memory of the LSASS. For example, the adversary can modify the SAM and SYSTEM files.

IDDS0017Data source and componentCommand: Command ExecutionDescription

Monitor executed commands and arguments that may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). Remote access tools may contain built-in features or incorporate existing tools like Mimikatz. PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module, which may require additional logging features to be configured in the operating system to collect necessary information for analysis.

Note: Event ID 4104 from the “Microsoft-Windows-PowerShell/Operational” log captures Powershell script blocks, whose contents can be further analyzed to determine if they’re performing LSASS dumping.

IDDS0022Data source and componentFile: File CreationDescription

Monitor for the unexpected creation of memory dump files for the LSASS process (e.g., lsass{*}.dmp).

Mitigation

IDM1028NameOperating System ConfigurationDescription

Consider disabling or restricting NTLM. Consider disabling WDigest authentication.

IDM1043NameCredential Access ProtectionDescription

With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping. It is not configured by default and has hardware and firmware system requirements. It also does not protect against all forms of credential dumping.

IDM1025NamePrivileged Process IntegrityDescription

On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.

IDM1026NamePrivileged Account ManagementDescription

Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

IDM1017NameUser TrainingDescription

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

IDM1040NameBehavior Prevention on EndpointDescription

On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing.

IDM1027NamePassword PoliciesDescription

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.