{"id":"f239b326-2f41-4d6b-9dfa-c846a60ef505","title":"Password Dumper Remote Thread in LSASS","description":"Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage.\nThe process in field Process is the malicious program. A single execution can lead to hundreds of events.\n","author":"Thomas Patzke","status":"stable","level":"high","date":"2017-02-19","modified":"2021-06-21","tags":["attack.credential-access","attack.s0005","attack.t1003.001"],"technique_ids":["T1003.001"],"logsource":{"product":"windows","category":"create_remote_thread"},"falsepositives":["Antivirus products"],"references":["https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm"],"source_path":"rules/windows/create_remote_thread/create_remote_thread_win_susp_password_dumper_lsass.yml","source_sha256":"edd8de9c4c4a509db4fe379624cd4badc34cfe6aeb305196f9d429ac8cbd24fd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/create_remote_thread/create_remote_thread_win_susp_password_dumper_lsass.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Password Dumper Remote Thread in LSASS\nid: f239b326-2f41-4d6b-9dfa-c846a60ef505\nstatus: stable\ndescription: |\n    Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage.\n    The process in field Process is the malicious program. A single execution can lead to hundreds of events.\nreferences:\n    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm\nauthor: Thomas Patzke\ndate: 2017-02-19\nmodified: 2021-06-21\ntags:\n    - attack.credential-access\n    - attack.s0005\n    - attack.t1003.001\nlogsource:\n    product: windows\n    category: create_remote_thread\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        StartModule: ''\n    condition: selection\nfalsepositives:\n    - Antivirus products\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/f239b326-2f41-4d6b-9dfa-c846a60ef505.json","kind":"sigma"}