Data Source: Sysmon Only

Suspicious WMI Event Subscription Created

Oct 3, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Persistence Data Source: Sysmon Only ·

Detects the creation of a WMI Event Subscription. Attackers can abuse this mechanism for persistence or to elevate to SYSTEM privileges.

Potential Credential Access via DuplicateHandle in LSASS

Jul 6, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Sysmon Only ·

Share on:

Identifies suspicious access to an LSASS handle via DuplicateHandle from an unknown call trace module. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump LSASS memory for credential access.

Potential Credential Access via LSASS Memory Dump

Jul 6, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Sysmon Only ·

Share on:

Identifies suspicious access to LSASS handle from a call trace pointing to DBGHelp.dll or DBGCore.dll, which both export the MiniDumpWriteDump method that can be used to dump LSASS memory content in preparation for credential access.

Potential LSASS Memory Dump via PssCaptureSnapShot

Jul 6, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Sysmon Only ·

Share on:

Identifies suspicious access to an LSASS handle via PssCaptureSnapShot where two successive process accesses are performed by the same process and target two different instances of LSASS. This may indicate an attempt to evade detection and dump LSASS memory for credential access.

Suspicious LSASS Access via MalSecLogon

Jul 6, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Sysmon Only ·

Share on:

Identifies suspicious access to LSASS handle from a call trace pointing to seclogon.dll and with a suspicious access rights value. This may indicate an attempt to leak an LSASS handle via abusing the Secondary Logon service in preparation for credential access.

Suspicious Lsass Process Access

Jul 6, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Sysmon Only ·

Share on:

Identifies access attempts to LSASS handle, this may indicate an attempt to dump credentials from Lsass memory.

Suspicious Process Access via Direct System Call

Jul 6, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Resources: Investigation Guide Data Source: Sysmon Only ·

Share on:

Identifies suspicious process access events from an unknown memory region. Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It's possible to bypass hooked functions by writing malicious functions that call syscalls directly.

Suspicious Process Creation CallTrace

Jul 6, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Resources: Investigation Guide Data Source: Sysmon Only ·

Share on:

Identifies when a process is created and immediately accessed from an unknown memory code region and by the same parent process. This may indicate a code injection attempt.

Potential Credential Access via Renamed COM+ Services DLL

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Sysmon Only ·

Share on:

Identifies suspicious renamed COMSVCS.DLL Image Load, which exports the MiniDump function that can be used to dump a process memory. This may indicate an attempt to dump LSASS memory while bypassing command-line based detection in preparation for credential access.

Potential LSASS Clone Creation via PssCaptureSnapShot

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: Sysmon Only ·

Share on:

Identifies the creation of an LSASS process clone via PssCaptureSnapShot where the parent process is the initial LSASS process instance. This may indicate an attempt to evade detection and dump LSASS memory for credential access.

Privilege Escalation via Rogue Named Pipe Impersonation

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Data Source: Sysmon Only ·

Share on:

Identifies a privilege escalation attempt via rogue named pipe impersonation. An adversary may abuse this technique by masquerading as a known named pipe and manipulating a privileged process to connect to it.

Process Injection by the Microsoft Build Engine

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Data Source: Sysmon Only ·

Share on:

An instance of MSBuild, the Microsoft Build Engine, created a thread in another process. This technique is sometimes used to evade detection or elevate privileges.