Potential Credential Access via LSASS Memory Dump

  1[metadata]
  2creation_date = "2021/10/07"
  3integration = ["windows"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies suspicious access to LSASS handle from a call trace pointing to DBGHelp.dll or DBGCore.dll, which both export
 11the MiniDumpWriteDump method that can be used to dump LSASS memory content in preparation for credential access.
 12"""
 13from = "now-9m"
 14index = ["winlogbeat-*", "logs-windows.sysmon_operational-*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Potential Credential Access via LSASS Memory Dump"
 18references = [
 19    "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz",
 20    "https://www.elastic.co/security-labs/detect-credential-access",
 21    "https://www.elastic.co/security-labs/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper",
 22]
 23risk_score = 73
 24rule_id = "9960432d-9b26-409f-972b-839a959e79e2"
 25severity = "high"
 26tags = [
 27    "Domain: Endpoint",
 28    "OS: Windows",
 29    "Use Case: Threat Detection",
 30    "Tactic: Credential Access",
 31    "Data Source: Sysmon",
 32    "Resources: Investigation Guide",
 33    "Noise: Low",
 34    "Performance: Normal",
 35    "Rule Type: Event Correlation (EQL)",
 36    "Platform: Windows",
 37]
 38timestamp_override = "event.ingested"
 39type = "eql"
 40
 41query = '''
 42process where host.os.type == "windows" and event.code == "10" and
 43  winlog.event_data.TargetImage : "?:\\WINDOWS\\system32\\lsass.exe" and
 44
 45  /* dbgcore.dll hosts MiniDumpWriteDump on modern Windows; dbghelp-only traces are non-dump usage */
 46  winlog.event_data.CallTrace : "*dbgcore*" and
 47
 48  /* crash handlers */
 49  not process.executable : (
 50        "?:\\Windows\\System32\\WerFault.exe",
 51        "?:\\Windows\\SysWOW64\\WerFault.exe",
 52        "?:\\Windows\\System32\\WerFaultSecure.exe"
 53      )
 54'''
 55
 56note = """## Triage and analysis
 57
 58### Investigating Potential Credential Access via LSASS Memory Dump
 59
 60#### Possible investigation steps
 61
 62- What did the process-access event prove?
 63  - Focus: `winlog.event_data.SourceImage`, `winlog.event_data.SourceProcessGUID`, `winlog.event_data.TargetImage`, `winlog.event_data.GrantedAccess`, and `winlog.event_data.CallTrace`.
 64  - Implication: escalate on a non-WerFault source touching LSASS with dbgcore in the call trace plus any corroborator; lower concern only when the tuple matches a stable EDR, crash-analysis, support, or authorized-test workflow on that `host.id`.
 65
 66- Does the source process match a recognized diagnostic tool?
 67  - Focus: recover the process start on the same `host.id` using `winlog.event_data.SourceProcessGUID` or `process.entity_id`, then review `process.executable`, `process.command_line`, `process.pe.original_file_name`, `process.code_signature.subject_name`, and `process.code_signature.trusted`. $investigate_0
 68  - Hint: if the source lacks `winlog.event_data.SourceProcessGUID`, fall back to `winlog.event_data.SourceImage`, `host.id`, and a tight window around `@timestamp`; if PE or signature metadata is absent, keep identity unresolved rather than inferring trust from path.
 69  - Implication: escalate when the recovered source is unsigned, renamed, user-writable, or uses MiniDumpWriteDump-adjacent arguments such as ProcDump-style switches or rundll32 with comsvcs.dll; if process-start telemetry is unavailable, treat identity as unresolved and do not close on `winlog.event_data.SourceImage` alone.
 70
 71- Does the recovered launch chain explain why this process would touch LSASS?
 72  - Focus: `process.command_line`, `process.parent.executable`, `process.parent.command_line`, `process.Ext.authentication_id`, and `user.id`; use `process.Ext.ancestry` when parent context is incomplete.
 73  - Implication: escalate when shells, script hosts, Office, browsers, archive tools, or remote-admin launchers start the accessor, or when `user.id` does not fit recognized troubleshooting; record `process.Ext.authentication_id` only as a later session bridge, and treat missing lineage as unresolved rather than benign.
 74
 75- Do same-source file events show dump creation, rename, or staging?
 76  - Focus: same-host file events for recovered `process.entity_id`, or `host.id` plus `process.pid` in a tight alert window; read `file.path`, `file.name`, `file.Ext.original.path`, and `file.size`. $investigate_1
 77  - Implication: escalate when the accessor writes dump output to temp, public, user-writable, or share paths, or renames it into archives or deceptive extensions; missing file telemetry is unresolved, not benign.
 78
 79- Do surrounding process events show dump handling, archive, copy, or cleanup?
 80  - Focus: child process starts from the recovered accessor on the same `host.id`, especially `process.parent.entity_id`, `process.executable`, `process.command_line`, and `@timestamp`. $investigate_2
 81  - Hint: sibling process review remains a manual expansion from the recovered parent/session context.
 82  - Implication: escalate when archivers, copy tools, PowerShell, rundll32, or cleanup commands appear immediately before or after the access; if process telemetry is sparse, preserve the gap and rely on the access tuple plus other corroborators.
 83
 84- Do authentication events suggest the account pivoted after the access?
 85  - Why: MiniDumpWriteDump-style LSASS access is usually a precursor step; later credential use matters more than the access alone.
 86  - Focus: after process recovery, use `process.Ext.authentication_id` and `host.id` to review authentication events via `winlog.event_data.TargetLogonId`; search `winlog.event_data.SubjectLogonId` separately for "4648" explicit-credential context.
 87  - Hint: if the process does not preserve `process.Ext.authentication_id`, skip the auth bridge and record the gap.
 88  - Implication: escalate when the linked session or `user.id` shows unexpected remote logons, explicit-credential use, or admin-share access soon after; missing authentication telemetry is unresolved, not benign.
 89
 90- If source identity, artifacts, or follow-on activity remain suspicious, do related alerts widen scope?
 91  - Focus: related `user.id` alerts for credential access, lateral movement, privilege escalation, or suspicious authentication. $investigate_3
 92  - Hint: compare `host.id` alerts to separate account reuse from host-local dump staging. $investigate_4
 93  - Implication: broaden when the same user or host also triggers dumping, suspicious logon, lateral movement, or exfiltration findings; keep local when related alerts are absent.
 94
 95- Escalate when LSASS access plus one meaningful corroborator points to unauthorized dump preparation or credential use; close only when identity, access tuple, launch, artifacts, authentication, and scope align with one recognized benign workflow; preserve and escalate if mixed or incomplete.
 96
 97### False positive analysis
 98
 99- Recognized EDR, crash-analysis, vendor-support, or authorized testing tooling can legitimately touch LSASS through dbgcore. Close only when the alert tuple, recovered source identity, parent context, `user.id`, and `host.id` all point to that same workflow, with no contradictory dump artifact or post-access authentication evidence. Case records, inventories, and owner confirmation can corroborate but not replace the telemetry match.
100- Before exceptioning, validate recurrence for the same recovered tool identity, signer, parent context, `winlog.event_data.SourceImage`, `user.id`, and `host.id`. Avoid exceptions on `winlog.event_data.CallTrace`, `winlog.event_data.TargetImage`, or LSASS access alone.
101
102### Response and remediation
103
104- If confirmed benign, reverse temporary containment and document the alert tuple, recovered source identity, parent context, `user.id`, `host.id`, and absence of contradictory dump or post-access authentication evidence. Create an exception only if the same stable workflow recurs.
105- If suspicious but unconfirmed, preserve the full alert event, recovered source process event, dump artifacts, linked authentication records, `user.id`, and `host.id` before containment. Apply reversible containment first, such as heightened monitoring or temporary restrictions on the affected `host.id`; weigh host criticality before isolating domain controllers or other privileged systems, and escalate to isolation only when dump artifacts or linked authentication evidence indicates likely credential exposure.
106- If confirmed malicious, preserve the alert tuple, source process identifiers, command line, parent context, dump artifact paths, and linked authentication evidence before terminating processes or deleting files. Then isolate the endpoint; if direct response is unavailable, escalate with the preserved artifact set. Restrict affected share paths when share-staged dumps were identified.
107- On servers, jump hosts, or privileged admin systems, scope which local, cached, service, or administrative credentials may have been exposed, then reset or rotate affected credentials according to their role and exposure.
108- Before eradication, review related hosts and users for the same source image, dump path pattern, or transfer target. Then remove dump utilities, scripts, archives, copied dumps, persistence mechanisms, and remediate the privilege path or initial access route that enabled the LSASS access.
109- Post-incident hardening: retain Sysmon Event ID 10 plus supporting process, file, and authentication telemetry, and document adjacent LSASS dump paths such as ProcDump-style switches or rundll32 with comsvcs.dll for the detection engineering team.
110"""
111
112setup = """## Setup
113
114This rule requires Sysmon telemetry to be enabled and ingested.
115
116Setup instructions: https://ela.st/sysmon-event-10-setup
117"""
118
119[rule.investigation_fields]
120field_names = [
121    "@timestamp",
122    "host.name",
123    "host.id",
124    "user.name",
125    "user.id",
126    "process.entity_id",
127    "process.pid",
128    "process.executable",
129    "process.command_line",
130    "winlog.event_data.SourceProcessGUID",
131    "winlog.event_data.SourceImage",
132    "winlog.event_data.TargetImage",
133    "winlog.event_data.GrantedAccess",
134    "winlog.event_data.CallTrace",
135]
136
137[transform]
138
139[[transform.investigate]]
140label = "Source process events by GUID"
141description = ""
142providers = [
143  [
144    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
145    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{winlog.event_data.SourceProcessGUID}}", valueType = "string" },
146    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
147  ],
148  [
149    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
150    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
151    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
152  ]
153]
154relativeFrom = "now-1h"
155relativeTo = "now"
156
157[[transform.investigate]]
158label = "File activity for the source process"
159description = ""
160providers = [
161  [
162    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
163    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{winlog.event_data.SourceProcessGUID}}", valueType = "string" },
164    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
165  ],
166  [
167    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
168    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
169    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
170  ]
171]
172relativeFrom = "now-1h"
173relativeTo = "now"
174
175[[transform.investigate]]
176label = "Child process events for the source process"
177description = ""
178providers = [
179  [
180    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
181    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{winlog.event_data.SourceProcessGUID}}", valueType = "string" },
182    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
183  ],
184  [
185    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
186    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
187    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
188  ]
189]
190relativeFrom = "now-1h"
191relativeTo = "now"
192
193[[transform.investigate]]
194label = "Alerts associated with the user"
195description = ""
196providers = [
197  [
198    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
199    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
200  ]
201]
202relativeFrom = "now-48h/h"
203relativeTo = "now"
204
205[[transform.investigate]]
206label = "Alerts associated with the host"
207description = ""
208providers = [
209  [
210    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
211    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
212  ]
213]
214relativeFrom = "now-48h/h"
215relativeTo = "now"
216
217[[rule.threat]]
218framework = "MITRE ATT&CK"
219[[rule.threat.technique]]
220id = "T1003"
221name = "OS Credential Dumping"
222reference = "https://attack.mitre.org/techniques/T1003/"
223[[rule.threat.technique.subtechnique]]
224id = "T1003.001"
225name = "LSASS Memory"
226reference = "https://attack.mitre.org/techniques/T1003/001/"
227
228[rule.threat.tactic]
229id = "TA0006"
230name = "Credential Access"
231reference = "https://attack.mitre.org/tactics/TA0006/"
232[[rule.threat]]
233framework = "MITRE ATT&CK"
234[[rule.threat.technique]]
235id = "T1106"
236name = "Native API"
237reference = "https://attack.mitre.org/techniques/T1106/"
238
239[rule.threat.tactic]
240id = "TA0002"
241name = "Execution"
242reference = "https://attack.mitre.org/tactics/TA0002/"