{"id":"a4b25073-8947-489c-a8dd-93b41c23f26d","title":"Windows LAPS Credential Dump From Entra ID","description":"Detects when an account dumps the LAPS password from Entra ID.","author":"andrewdanis","status":"test","level":"high","date":"2024-06-26","modified":"","tags":["attack.privilege-escalation","attack.persistence","attack.t1098.005"],"technique_ids":["T1098.005"],"logsource":{"product":"azure","service":"auditlogs"},"falsepositives":["Approved activity performed by an Administrator."],"references":["https://twitter.com/NathanMcNulty/status/1785051227568632263","https://www.cloudcoffee.ch/microsoft-365/configure-windows-laps-in-microsoft-intune/","https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487"],"source_path":"rules/cloud/azure/audit_logs/azure_auditlogs_laps_credential_dumping.yml","source_sha256":"14a8472173d5842b2e7b7a4ef5d2fa5443985d233e079509c53953c818f1713a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_auditlogs_laps_credential_dumping.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows LAPS Credential Dump From Entra ID\nid: a4b25073-8947-489c-a8dd-93b41c23f26d\nstatus: test\ndescription: Detects when an account dumps the LAPS password from Entra ID.\nreferences:\n    - https://twitter.com/NathanMcNulty/status/1785051227568632263\n    - https://www.cloudcoffee.ch/microsoft-365/configure-windows-laps-in-microsoft-intune/\n    - https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487\nauthor: andrewdanis\ndate: 2024-06-26\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1098.005\nlogsource:\n    product: azure\n    service: auditlogs\ndetection:\n    selection:\n        category: 'Device'\n        activityType|contains: 'Recover device local administrator password'\n        additionalDetails.additionalInfo|contains: 'Successfully recovered local credential by device id'\n    condition: selection\nfalsepositives:\n    - Approved activity performed by an Administrator.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1098.005","id":"T1098.005","name":"Device Registration","page":"techniques/enterprise/T1098.005/"}],"data_path":"data/detection-rules/a4b25073-8947-489c-a8dd-93b41c23f26d.json","kind":"sigma"}