Potential Credential Access via Windows Utilities

edit

Potential Credential Access via Windows Utilities

edit

Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-endpoint.events.*
  • logs-windows.*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Credential Access

Version: 5

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
process where event.type in ("start", "process_started") and
/* update here with any new lolbas with dump capability */
(process.pe.original_file_name == "procdump" and process.args : "-ma") or
(process.name : "ProcessDump.exe" and not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Cisco Systems\\.*""") or
(process.pe.original_file_name == "WriteMiniDump.exe" and not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Steam\\.*""") or
(process.pe.original_file_name == "RUNDLL32.EXE" and (process.args : "MiniDump*" or process.command_line : "*comsvcs.dll*#24*")) or
(process.pe.original_file_name == "RdrLeakDiag.exe" and process.args : "/fullmemdmp") or
(process.pe.original_file_name == "SqlDumper.exe" and process.args : "0x01100*") or
(process.pe.original_file_name == "TTTracer.exe" and process.args : "-dumpFull" and process.args : "-attach") or
(process.pe.original_file_name == "ntdsutil.exe" and process.args : "create*full*") or
(process.pe.original_file_name == "diskshadow.exe" and process.args : "/s")

Framework: MITRE ATT&CKTM