{"id":"9bd012ee-0dff-44d7-84a0-aa698cfd87a3","title":"LSASS Memory Access by Tool With Dump Keyword In Name","description":"Detects LSASS process access requests from a source process with the \"dump\" keyword in its image name.","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-10","modified":"2023-11-29","tags":["attack.credential-access","attack.t1003.001","attack.s0002"],"technique_ids":["T1003.001"],"logsource":{"category":"process_access","product":"windows"},"falsepositives":["Rare programs that contain the word dump in their name and access lsass"],"references":["https://twitter.com/_xpn_/status/1491557187168178176","https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz"],"source_path":"rules/windows/process_access/proc_access_win_lsass_dump_keyword_image.yml","source_sha256":"233028142e66b0de2eb4a98192136cf6118e5808134d1302c3288b7fb6074ae0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_lsass_dump_keyword_image.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: LSASS Memory Access by Tool With Dump Keyword In Name\nid: 9bd012ee-0dff-44d7-84a0-aa698cfd87a3\nstatus: test\ndescription: Detects LSASS process access requests from a source process with the \"dump\" keyword in its image name.\nreferences:\n    - https://twitter.com/_xpn_/status/1491557187168178176\n    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-02-10\nmodified: 2023-11-29\ntags:\n    - attack.credential-access\n    - attack.t1003.001\n    - attack.s0002\nlogsource:\n    category: process_access\n    product: windows\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        SourceImage|contains: 'dump'\n        GrantedAccess|endswith:\n            - '10'\n            - '30'\n            - '50'\n            - '70'\n            - '90'\n            - 'B0'\n            - 'D0'\n            - 'F0'\n            - '18'\n            - '38'\n            - '58'\n            - '78'\n            - '98'\n            - 'B8'\n            - 'D8'\n            - 'F8'\n            - '1A'\n            - '3A'\n            - '5A'\n            - '7A'\n            - '9A'\n            - 'BA'\n            - 'DA'\n            - 'FA'\n            - '0x14C2'  # https://github.com/b4rtik/ATPMiniDump/blob/76304f93b390af3bb66e4f451ca16562a479bdc9/ATPMiniDump/ATPMiniDump.c\n            - 'FF'\n    condition: selection\nfalsepositives:\n    - Rare programs that contain the word dump in their name and access lsass\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/9bd012ee-0dff-44d7-84a0-aa698cfd87a3.json","kind":"sigma"}