{"id":"f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9","title":"Credential Dumping Activity By Python Based Tool","description":"Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.","author":"Bhabesh Raj, Jonhnathan Ribeiro","status":"stable","level":"high","date":"2023-11-27","modified":"2023-11-29","tags":["attack.credential-access","attack.t1003.001","attack.s0349"],"technique_ids":["T1003.001"],"logsource":{"category":"process_access","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/bh4b3sh/status/1303674603819081728","https://github.com/skelsec/pypykatz"],"source_path":"rules/windows/process_access/proc_access_win_lsass_python_based_tool.yml","source_sha256":"2ab74b2409374cfb9b6c340b099083ffa01805847a6aa9ce8e169e891bf2f62a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_lsass_python_based_tool.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Credential Dumping Activity By Python Based Tool\nid: f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9\nrelated:\n    - id: 4b9a8556-99c4-470b-a40c-9c8d02c77ed0\n      type: obsolete\n    - id: 7186e989-4ed7-4f4e-a656-4674b9e3e48b\n      type: obsolete\nstatus: stable\ndescription: Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.\nreferences:\n    - https://twitter.com/bh4b3sh/status/1303674603819081728\n    - https://github.com/skelsec/pypykatz\nauthor: Bhabesh Raj, Jonhnathan Ribeiro\ndate: 2023-11-27\nmodified: 2023-11-29\ntags:\n    - attack.credential-access\n    - attack.t1003.001\n    - attack.s0349\nlogsource:\n    category: process_access\n    product: windows\ndetection:\n    selection:\n        TargetImage|endswith: '\\lsass.exe'\n        CallTrace|contains|all:\n            - '_ctypes.pyd+'\n            - ':\\Windows\\System32\\KERNELBASE.dll+'\n            - ':\\Windows\\SYSTEM32\\ntdll.dll+'\n        CallTrace|contains:\n            - 'python27.dll+'\n            - 'python3*.dll+'\n        GrantedAccess: '0x1FFFFF'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9.json","kind":"sigma"}