{"id":"4be8b654-0c01-4c9d-a10c-6b28467fc651","title":"LSASS Access From Potentially White-Listed Processes","description":"Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference\n","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-10","modified":"2023-11-29","tags":["attack.credential-access","attack.t1003.001","attack.s0002"],"technique_ids":["T1003.001"],"logsource":{"category":"process_access","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/_xpn_/status/1491557187168178176","https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz","https://twitter.com/mrd0x/status/1460597833917251595"],"source_path":"rules/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml","source_sha256":"ab1223450ca88a27718a850192cdfc4ee9740c39a1d4aab105aa6b81f71d7a77","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: LSASS Access From Potentially White-Listed Processes\nid: 4be8b654-0c01-4c9d-a10c-6b28467fc651\nstatus: test\ndescription: |\n    Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference\nreferences:\n    - https://twitter.com/_xpn_/status/1491557187168178176\n    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz\n    - https://twitter.com/mrd0x/status/1460597833917251595\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-02-10\nmodified: 2023-11-29\ntags:\n    - attack.credential-access\n    - attack.t1003.001\n    - attack.s0002\nlogsource:\n    category: process_access\n    product: windows\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        SourceImage|endswith:\n            - '\\TrolleyExpress.exe'  # Citrix\n            - '\\ProcessDump.exe'     # Cisco Jabber\n            - '\\dump64.exe'          # Visual Studio\n        GrantedAccess|endswith:\n            - '10'\n            - '30'\n            - '50'\n            - '70'\n            - '90'\n            - 'B0'\n            - 'D0'\n            - 'F0'\n            - '18'\n            - '38'\n            - '58'\n            - '78'\n            - '98'\n            - 'B8'\n            - 'D8'\n            - 'F8'\n            - '1A'\n            - '3A'\n            - '5A'\n            - '7A'\n            - '9A'\n            - 'BA'\n            - 'DA'\n            - 'FA'\n            - '0x14C2'  # https://github.com/b4rtik/ATPMiniDump/blob/76304f93b390af3bb66e4f451ca16562a479bdc9/ATPMiniDump/ATPMiniDump.c\n            - 'FF'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/4be8b654-0c01-4c9d-a10c-6b28467fc651.json","kind":"sigma"}