Windows LAPS Credential Dump From Entra ID — Sigma Rule

Rule metadata and linked tags

Author: andrewdanis. Source status: test; severity: high. Source dates: 2024-06-26 / not supplied.

{
  "product": "azure",
  "service": "auditlogs"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 14a8472173d5842b2e7b7a4ef5d2fa5443985d233e079509c53953c818f1713a

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Windows LAPS Credential Dump From Entra ID
id: a4b25073-8947-489c-a8dd-93b41c23f26d
status: test
description: Detects when an account dumps the LAPS password from Entra ID.
references:
    - https://twitter.com/NathanMcNulty/status/1785051227568632263
    - https://www.cloudcoffee.ch/microsoft-365/configure-windows-laps-in-microsoft-intune/
    - https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487
author: andrewdanis
date: 2024-06-26
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098.005
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        category: 'Device'
        activityType|contains: 'Recover device local administrator password'
        additionalDetails.additionalInfo|contains: 'Successfully recovered local credential by device id'
    condition: selection
falsepositives:
    - Approved activity performed by an Administrator.
level: high

Original YAML and metadata in JSON

False positives

• Approved activity performed by an Administrator.

Source references

• https://twitter.com/NathanMcNulty/status/1785051227568632263
• https://www.cloudcoffee.ch/microsoft-365/configure-windows-laps-in-microsoft-intune/
• https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-windows-local-administrator-password-solution-with/ba-p/1942487