Potential Credential Access via Windows Utilities

Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access.

Elastic rule (View on GitHub)

  1[metadata]
  2creation_date = "2020/11/24"
  3integration = ["endpoint", "windows"]
  4maturity = "production"
  5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
  6min_stack_version = "8.3.0"
  7updated_date = "2024/03/08"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database
 13(NTDS.dit) in preparation for credential access.
 14"""
 15from = "now-9m"
 16index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*", "endgame-*", "logs-system.security*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "Potential Credential Access via Windows Utilities"
 20note = """## Triage and analysis
 21
 22### Investigating Potential Credential Access via Windows Utilities
 23
 24Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.
 25
 26The `Ntds.dit` file is a database that stores Active Directory data, including information about user objects, groups, and group membership.
 27
 28This rule looks for the execution of utilities that can extract credential data from the LSASS memory and Active Directory `Ntds.dit` file.
 29
 30#### Possible investigation steps
 31
 32- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 33- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
 34- Investigate other alerts associated with the user/host during the past 48 hours.
 35- Examine the command line to identify what information was targeted.
 36- Identify the target computer and its role in the IT environment.
 37
 38### False positive analysis
 39
 40- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
 41
 42### Response and remediation
 43
 44- Initiate the incident response process based on the outcome of the triage.
 45- If the host is a domain controller (DC):
 46  - Activate your incident response plan for total Active Directory compromise.
 47  - Review the privileges assigned to users that can access the DCs, to ensure that the least privilege principle is being followed and to reduce the attack surface.
 48- Isolate the involved hosts to prevent further post-compromise behavior.
 49- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
 50- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
 51- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 52- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 53"""
 54references = ["https://lolbas-project.github.io/"]
 55risk_score = 73
 56rule_id = "00140285-b827-4aee-aa09-8113f58a08f3"
 57setup = """## Setup
 58
 59If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
 60events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
 61Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
 62`event.ingested` to @timestamp.
 63For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
 64"""
 65severity = "high"
 66tags = [
 67    "Domain: Endpoint",
 68    "OS: Windows",
 69    "Use Case: Threat Detection",
 70    "Tactic: Credential Access",
 71    "Tactic: Defense Evasion",
 72    "Resources: Investigation Guide",
 73    "Data Source: Elastic Endgame",
 74    "Data Source: Elastic Defend"
 75]
 76timestamp_override = "event.ingested"
 77type = "eql"
 78
 79query = '''
 80process where host.os.type == "windows" and event.type == "start" and
 81(
 82  (
 83    (?process.pe.original_file_name : "procdump" or process.name : "procdump.exe") and process.args : "-ma"
 84  ) or
 85  (
 86    process.name : "ProcessDump.exe" and not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Cisco Systems\\.*"""
 87  ) or
 88  (
 89    (?process.pe.original_file_name : "WriteMiniDump.exe" or process.name : "WriteMiniDump.exe") and
 90      not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Steam\\.*"""
 91  ) or
 92  (
 93    (?process.pe.original_file_name : "RUNDLL32.EXE" or process.name : "RUNDLL32.exe") and
 94      (process.args : "MiniDump*" or process.command_line : "*comsvcs.dll*#24*")
 95  ) or
 96  (
 97    (?process.pe.original_file_name : "RdrLeakDiag.exe" or process.name : "RdrLeakDiag.exe") and
 98      process.args : "/fullmemdmp"
 99  ) or
100  (
101    (?process.pe.original_file_name : "SqlDumper.exe" or process.name : "SqlDumper.exe") and
102      process.args : "0x01100*") or
103  (
104    (?process.pe.original_file_name : "TTTracer.exe" or process.name : "TTTracer.exe") and
105      process.args : "-dumpFull" and process.args : "-attach") or
106  (
107    (?process.pe.original_file_name : "ntdsutil.exe" or process.name : "ntdsutil.exe") and
108      process.args : "create*full*") or
109  (
110    (?process.pe.original_file_name : "diskshadow.exe" or process.name : "diskshadow.exe") and process.args : "/s")
111)
112'''
113
114
115[[rule.threat]]
116framework = "MITRE ATT&CK"
117[[rule.threat.technique]]
118id = "T1003"
119name = "OS Credential Dumping"
120reference = "https://attack.mitre.org/techniques/T1003/"
121[[rule.threat.technique.subtechnique]]
122id = "T1003.001"
123name = "LSASS Memory"
124reference = "https://attack.mitre.org/techniques/T1003/001/"
125
126[[rule.threat.technique.subtechnique]]
127id = "T1003.003"
128name = "NTDS"
129reference = "https://attack.mitre.org/techniques/T1003/003/"
130
131
132
133[rule.threat.tactic]
134id = "TA0006"
135name = "Credential Access"
136reference = "https://attack.mitre.org/tactics/TA0006/"
137
138[[rule.threat]]
139framework = "MITRE ATT&CK"
140[[rule.threat.technique]]
141id = "T1218"
142name = "System Binary Proxy Execution"
143reference = "https://attack.mitre.org/techniques/T1218/"
144[[rule.threat.technique.subtechnique]]
145id = "T1218.011"
146name = "Rundll32"
147reference = "https://attack.mitre.org/techniques/T1218/011/"
148
149
150
151[rule.threat.tactic]
152id = "TA0005"
153name = "Defense Evasion"
154reference = "https://attack.mitre.org/tactics/TA0005/"

Triage and analysis

Investigating Potential Credential Access via Windows Utilities

Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.

The Ntds.dit file is a database that stores Active Directory data, including information about user objects, groups, and group membership.

This rule looks for the execution of utilities that can extract credential data from the LSASS memory and Active Directory Ntds.dit file.

Possible investigation steps

  • Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
  • Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
  • Investigate other alerts associated with the user/host during the past 48 hours.
  • Examine the command line to identify what information was targeted.
  • Identify the target computer and its role in the IT environment.

False positive analysis

  • This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.

Response and remediation

  • Initiate the incident response process based on the outcome of the triage.
  • If the host is a domain controller (DC):
    • Activate your incident response plan for total Active Directory compromise.
    • Review the privileges assigned to users that can access the DCs, to ensure that the least privilege principle is being followed and to reduce the attack surface.
  • Isolate the involved hosts to prevent further post-compromise behavior.
  • Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
  • Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
  • Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
  • Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).

References

Related rules

to-top