Potential LSASS Clone Creation via PssCaptureSnapShot

  1[metadata]
  2creation_date = "2021/11/27"
  3integration = ["windows", "system"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the creation of an LSASS process clone via PssCaptureSnapShot where the parent process is the initial LSASS
 11process instance. This may indicate an attempt to evade detection and dump LSASS memory for credential access.
 12"""
 13from = "now-9m"
 14index = ["logs-system.security*", "logs-windows.forwarded*", "winlogbeat-*"]
 15language = "eql"
 16license = "Elastic License v2"
 17name = "Potential LSASS Clone Creation via PssCaptureSnapShot"
 18references = [
 19    "https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/",
 20    "https://medium.com/@Achilles8284/the-birth-of-a-process-part-2-97c6fb9c42a2",
 21]
 22risk_score = 73
 23rule_id = "a16612dd-b30e-4d41-86a0-ebe70974ec00"
 24severity = "high"
 25tags = [
 26    "Domain: Endpoint",
 27    "OS: Windows",
 28    "Use Case: Threat Detection",
 29    "Tactic: Credential Access",
 30    "Data Source: Windows Security Event Logs",
 31    "Resources: Investigation Guide",
 32    "Noise: Low",
 33    "Performance: Normal",
 34    "Rule Type: Event Correlation (EQL)",
 35    "Platform: Windows",
 36]
 37timestamp_override = "event.ingested"
 38type = "eql"
 39
 40query = '''
 41process where host.os.type == "windows" and event.code:"4688" and
 42  process.executable : "?:\\Windows\\System32\\lsass.exe" and
 43  process.parent.executable : "?:\\Windows\\System32\\lsass.exe"
 44'''
 45
 46note = """## Triage and analysis
 47
 48### Investigating Potential LSASS Clone Creation via PssCaptureSnapShot
 49
 50#### Possible investigation steps
 51
 52- Does the alert-local 4688 event show the LSASS-clone pattern?
 53  - Focus: `event.code`, `process.executable`, `process.parent.executable`, `host.id`, `@timestamp`.
 54  - Implication: treat the alert as clone creation when both paths resolve to lsass.exe on one host; lower suspicion only when the tuple maps to stable EDR, forensic, or debugging workflow.
 55  - Hint: pivot with `host.id` plus `process.entity_id`; if absent, use `host.id`, `process.pid`, and a tight alert-time window.
 56
 57- Do surrounding 4688 events reveal the setup or dump-conversion chain?
 58  - Focus: same-host 4688 around `@timestamp`, especially `process.executable`, `process.command_line`, `process.parent.executable`, `user.id`, and terms such as "PssCaptureSnapshot", "MiniDumpWriteDump", "comsvcs", "rundll32", "WerFault", "procdump", "createdump", archive utilities, or cleanup commands. $investigate_0
 59  - Implication: escalate when shells, PowerShell, dump helpers, archive tools, cleanup, or remote-admin launchers appear without the same recognized collection workflow; absence of helpers leaves the clone unresolved, not benign.
 60
 61- If file telemetry exists, did the clone create dumps, archives, or renamed outputs?
 62  - Focus: same-host file or child-process telemetry for `file.path`, `file.Ext.original.path` matching ".dmp", ".zip", ".7z", or renamed outputs. $investigate_1. If unavailable, use surrounding 4688 commands with output files or archive utilities.
 63  - Implication: escalate when dump paths, archive names, or cleanup commands appear around clone creation. Missing file telemetry is unresolved, not benign.
 64
 65- Do authentication events show follow-on remote use, explicit credentials, or unusual logons?
 66  - Why: clone creation often precedes credential use; later auth can show post-dump pivoting.
 67  - Focus: same-host 4624, 4648, and 4625 around `@timestamp`, using `winlog.event_data.TargetUserName`, `winlog.logon.type`, and `source.ip`. $investigate_2
 68  - Implication: escalate when the host or user quickly shows new remote-interactive, service, or explicit-credential logons from unusual sources. If auth telemetry is missing, record the gap and keep the finding unresolved.
 69
 70- Does same-user or same-host activity repeat the evidence pattern?
 71  - Focus: same-user 48h alerts for helper commands, dump/archive names, or post-clone authentication. $investigate_3
 72  - Hint: if user scope is sparse or the host is shared, review same-host alerts for process, output, and authentication evidence. $investigate_4
 73  - Implication: broaden scope when helper-command, output, or authentication patterns repeat around clone windows; no repeat keeps response local but does not clear the clone.
 74
 75- Escalate for unauthorized LSASS clone creation, dump preparation, post-clone credential use, or clone creation on domain controllers, jump hosts, or privileged admin systems; close only when the alert tuple and recovery evidence bind to one recognized EDR, forensic, or debugging workflow with no conflicting dump-conversion, output, or authentication evidence; preserve artifacts and escalate when answers are mixed or visibility is incomplete.
 76
 77### False positive analysis
 78
 79- Recognized EDR/forensic collection or bounded lab validation can create snapshot-based clones. Require the alert tuple, helper command line, `user.id`, `host.id`, dump-output pattern, and no unexpected 4624 or 4648 activity inside that workflow; use records only to corroborate unresolved telemetry.
 80- Before creating an exception, validate that the same `host.id` and `user.id` cohort repeats the same process identity, helper-command, output-path, and authentication pattern across prior alerts from this rule. Avoid exceptions on "lsass.exe", `event.code`, or `host.id` alone.
 81
 82### Response and remediation
 83
 84- If confirmed benign, reverse temporary containment and document the collection workflow identity, launcher path, actor, host scope, dump-output pattern, and follow-on authentication pattern. Create an exception only if that pattern recurs across prior alerts.
 85- If suspicious but unconfirmed, preserve the alert 4688 event, surrounding helper-process events, command lines, dump/archive paths, rename evidence, affected identities, and post-clone authentication records before containment. Apply reversible containment first, such as heightened monitoring or temporary restrictions on remote admin access; escalate to host isolation only when dump artifacts or post-clone authentication confirm likely credential exposure and the host role can tolerate interruption.
 86- If confirmed malicious, preserve the alert event, helper-process chain, dump/archive paths, rename evidence, and affected identities before containment. Then isolate the host through endpoint response; if unavailable, escalate with preserved evidence. Block confirmed remote-auth or transfer sources before cleanup.
 87- On domain controllers, jump hosts, or privileged admin systems, scope which local, cached, service, or domain credentials may have been exposed, then reset or rotate affected credentials before removing collected artifacts.
 88- Before eradication, review related hosts and users for the same helper-process pattern, dump path, `winlog.logon.type`, or `source.ip` indicators. Then remove dump files, archives, helper tools, and persistence, and remediate the access or privilege path that enabled clone creation.
 89- Post-incident hardening: restrict memory-acquisition and dump tooling to recognized admin cohorts, retain supplemental file telemetry where its absence limited the case, and document the confirmed workflow or malicious pattern for future triage.
 90"""
 91
 92setup = """## Setup
 93
 94Audit Process Creation and Command Line must be enabled to generate the events used by this rule.
 95Setup instructions: https://ela.st/audit-process-creation
 96"""
 97
 98[rule.investigation_fields]
 99field_names = [
100    "@timestamp",
101    "host.name",
102    "host.id",
103    "user.name",
104    "user.id",
105    "user.domain",
106    "process.entity_id",
107    "process.pid",
108    "process.executable",
109    "process.command_line",
110    "process.parent.entity_id",
111    "process.parent.pid",
112    "process.parent.name",
113    "process.parent.executable",
114    "process.parent.command_line",
115]
116
117[transform]
118
119[[transform.investigate]]
120label = "Same-host 4688 process creation events"
121description = ""
122providers = [
123  [
124    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
125    { excluded = false, field = "event.code", queryType = "phrase", value = "4688", valueType = "string" }
126  ]
127]
128relativeFrom = "now-1h"
129relativeTo = "now"
130
131[[transform.investigate]]
132label = "File activity on the affected host"
133description = ""
134providers = [
135  [
136    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
137    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
138  ]
139]
140relativeFrom = "now-1h"
141relativeTo = "now"
142
143[[transform.investigate]]
144label = "Authentication events on the affected host"
145description = ""
146providers = [
147  [
148    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
149    { excluded = false, field = "event.code", queryType = "phrase", value = "4624", valueType = "string" }
150  ],
151  [
152    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
153    { excluded = false, field = "event.code", queryType = "phrase", value = "4648", valueType = "string" }
154  ],
155  [
156    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
157    { excluded = false, field = "event.code", queryType = "phrase", value = "4625", valueType = "string" }
158  ]
159]
160relativeFrom = "now-1h"
161relativeTo = "now"
162
163[[transform.investigate]]
164label = "Alerts associated with the user"
165description = ""
166providers = [
167  [
168    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
169    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
170  ]
171]
172relativeFrom = "now-48h/h"
173relativeTo = "now"
174
175[[transform.investigate]]
176label = "Alerts associated with the host"
177description = ""
178providers = [
179  [
180    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
181    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
182  ]
183]
184relativeFrom = "now-48h/h"
185relativeTo = "now"
186
187[[rule.threat]]
188framework = "MITRE ATT&CK"
189[[rule.threat.technique]]
190id = "T1003"
191name = "OS Credential Dumping"
192reference = "https://attack.mitre.org/techniques/T1003/"
193[[rule.threat.technique.subtechnique]]
194id = "T1003.001"
195name = "LSASS Memory"
196reference = "https://attack.mitre.org/techniques/T1003/001/"
197
198[rule.threat.tactic]
199id = "TA0006"
200name = "Credential Access"
201reference = "https://attack.mitre.org/tactics/TA0006/"