attack.credential_access | Detection.FYI

Kerberoasting Activity - Initial query

Aug 10, 2024 · attack.credential_access attack.t1558.003 ·
Share on:

This rule will collect the data needed to start looking into possible kerberoasting activity. Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds. You can then set a threshold for the number of requests and time between the requests to turn this into an alert.

Read More
LAPS Credential Dumping Spoofing and Domain Controller Impersonation

Aug 10, 2024 · attack.credential_access attack.T1003 ·
Share on:

Identify LAPS credential dumping by looking for users accessing objects via Event ID 4662, and login authentication events via Event ID 4624. The two events must contain the same LogonID to track the same logon session. NOTE - The TargetLogonId has to match the SubjectLogonId. Not sure how to implement the logic using sigma, so I have left it as a placeholder. Make sure to change it depending on the SIEM you are using.

Read More
Using Lazagne to dump credentials

Aug 10, 2024 · attack.credential_access attack.t1555 ·
Share on:

Detects the use of lazagne looking into the command line execution.

Read More
Kerberos .kirbi Ticket Files

Mar 26, 2024 · attack.s0002 attack.credential_access attack.t1558 attack.t1558.003 ·
Share on:

Kerberos ticket files (.kirbi) are of interest to adversaries as they can contain sensitive data such as NTLM hashes that can be cracked offline. To perform these attacks, a unique file extension variable is defined within Mimikatz that designates the default extension as .kirbi. Part of the RedCanary 2024 Threat Detection Report.

Read More
Mimikatz Module Names

Mar 26, 2024 · attack.credential_access attack.t1003 attack.s0002 ·
Share on:

Identifies processes in which Mimikatz module names are observed as command-line parameters. Part of the RedCanary 2024 Threat Detection Report.

Read More
SecretsDump File Modification

Mar 26, 2024 · attack.credential_access attack.t1003 ·
Share on:

Impacket’s SecretsDump utility consistently involves the Windows Service Host (svchost.exe) writing randomly named .tmp files to the System32 directory. The following pseudo-detector should offer defenders a reliable method of detecting Impacket's SecretsDump utility. Part of the RedCanary 2024 Threat Detection Report.

Read More
Secretsdump.py Execution

Mar 26, 2024 · attack.s0357 attack.credential_access attack.t1003 attack.t1003.003 attack.t1003.006 ·
Share on:

This detection analytic identifies Impacket’s secretsdump.py script on a target host, which is the most common script we have observed in customer environments. secretsdump.py is remotely run on an adversary’s machine to steal credentials. The command is commonly executed by svchost.exe, where regsvc.dll is loaded which allows the export of credentials from the registry. The output is redirected to an eight-character TMP file within the System32 directory. Part of the RedCanary 2024 Threat Detection Report.

Read More
Suspicious Export Functionalities - Rundll32

Mar 26, 2024 · attack.defense_evasion attack.t1218 attack.t1218.011 attack.credential_access attack.t1003 ·
Share on:

Consider monitoring for instances of rundll32.exe running Windows native DLLs that have export functionalities that adversaries commonly leverage for executing malicious code and evading defensive controls. The following pseudo-analytic applies specifically to adversaries who use the MiniDump export functionality of comsvcs.dll to dump the contents of LSASS, but this logic could be adapted to detect other malicious activity as well. Part of the RedCanary 2024 Threat Detection Report.

Read More
Lazagne dumping credentials

Feb 23, 2024 · attack.credential_access attack.t1555 ·
Share on:

Detects the use of lazagne using command line execution.

Read More
Adding, Listing and Removing Credentials via Cmdkey CommandLine Ultility

Oct 30, 2023 · attack.credential_access attack.t1003.005 ·
Share on:

Detects the use of cmdkey to add, remove, or list credentials.

Read More
Possible Impacket Secretsdump.py Activity

Sep 1, 2023 · attack.s0357 attack.credential_access attack.t1003 attack.t1003.003 attack.t1003.006 ·
Share on:

Detects attempts to retrieve/dump credentials using the DL_DRSGetNCChanges() method.

Read More
Abnormal LSASS Child and Parent Process Relationships (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects potential LSASS abuse based on unusual parent-child process lineage patterns. Part of the RedCanary 2023 Threat Detection Report.

Read More
Abnormal LSASS Process Access and Injection (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects suspicious cross-process events where LSASS is accessed. Part of the RedCanary 2023 Threat Detection Report.

Read More
LSASS Running Under Non-Privileged User Context (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects instances of LSASS running under any non-privileged user context, which can indicate abuse. Part of the RedCanary 2023 Threat Detection Report.

Read More
Rundll32 Dumping Credentials with MiniDump Function (RedCanary Threat Detection Report)

May 10, 2023 · attack.credential_access attack.t1003.001 ·
Share on:

Detects processes that seem to be rundll32.exe along with a command line containing the term MiniDump. Part of the RedCanary 2023 Threat Detection Report.

Read More
Failed Logins with Different Accounts from Single Source - Linux

Apr 21, 2023 · attack.credential_access attack.t1110 ·
Share on:

Detects suspicious failed logins with different user accounts from a single source system

Read More
Sign-in Failure Bad Password Threshold

Apr 21, 2023 · attack.credential_access attack.t1110 ·
Share on:

Define a baseline threshold and then monitor and adjust to suit your organizational behaviors and limit false alerts from being generated.

Read More
Stored Credentials in Fake Files

Apr 21, 2023 · attack.credential_access attack.t1555 ·
Share on:

Search for accessing of fake files with stored credentials

Read More
Possible Impacket GetUserSPNs Activity

Apr 16, 2023 · attack.s0357 attack.credential_access attack.t1558 attack.t1558.003 ·
Share on:

Detects attempts to create vulnerable Kerberos Ticket Granting Service (TGS) tickets using the RC4-HMAC encryption type.

Read More
External Remote Service Logon from Public IP

Jan 23, 2023 · attack.initial_access attack.credential_access attack.t1133 attack.t1078 attack.t1110 ·
Share on:

Detects successful logon from public IP address via RDP, SMB, etc. This can indicate a publicly-exposed RDP or SMB port.

Read More
Mimikatz Command Line With Ticket Export

Jan 8, 2023 · attack.credential_access attack.t1003 attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 ·
Share on:

Detection of well-known mimikatz command line arguments. Added more commandline indicators from referenced rule by author - Teymur Kheirkhabarov, oscd.community

Read More
NTDSutil Pulling of NTDS.dit File

Nov 29, 2022 · attack.credential_access attack.t1003 attack.t1003.003 ·
Share on:

Detects use of the ntdsutil utility to pull ntds.dit (Active Directory database).

Read More
Abnormal LSASS Child and Parent Process Relationships

Nov 9, 2022 · attack.credential_access attack.t1003.001 ·
Share on:

Detects potential lsass.exe abuse based on unusual and suspicious parent-child relationships. Inspired by the 2022 Red Canary Threat Detection report.

Read More
Abnormal LSASS Process Access and Injection

Nov 9, 2022 · attack.credential_access attack.t1003.001 ·
Share on:

Detects obviously suspicious cross-process events targetting lsass.exe. Inspired by the 2022 Red Canary Threat Detection report.

Read More