IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Credential Acquisition via Registry Hive Dumping Credential Dumping - Prevented - Elastic Endgame »

› › ›

Credential Dumping - Detected - Elastic Endgame

edit

Credential Dumping - Detected - Elastic Endgame

edit

Elastic Endgame detected Credential Dumping. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Rule type: query

Rule indices:

endgame-*

Severity: high

Risk score: 73

Runs every: 10m

Searches indices from: now-15m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 10000

References: None

Tags:

Data Source: Elastic Endgame
Use Case: Threat Detection
Tactic: Credential Access

Version: 103

Rule authors:

Elastic

Rule license: Elastic License v2

Setup

edit

Setup

This rule is configured to generate more Max alerts per run than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.

IMPORTANT: The rule’s Max alerts per run setting can be superseded by the xpack.alerting.rules.run.alerts.max Kibana config setting, which determines the maximum alerts generated by any rule in the Kibana alerting framework. For example, if xpack.alerting.rules.run.alerts.max is set to 1000, this rule will still generate no more than 1000 alerts even if its own Max alerts per run is set higher.

To make sure this rule can generate as many alerts as it’s configured in its own Max alerts per run setting, increase the xpack.alerting.rules.run.alerts.max system setting accordingly.

NOTE: Changing xpack.alerting.rules.run.alerts.max is not possible in Serverless projects.

Rule query

edit

event.kind:alert and event.module:endgame and endgame.metadata.type:detection and (event.action:cred_theft_event or endgame.event_subtype_full:cred_theft_event)

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Credential Access
- ID: TA0006
- Reference URL: https://attack.mitre.org/tactics/TA0006/
Technique:
- Name: OS Credential Dumping
- ID: T1003
- Reference URL: https://attack.mitre.org/techniques/T1003/
Sub-technique:
- Name: LSASS Memory
- ID: T1003.001
- Reference URL: https://attack.mitre.org/techniques/T1003/001/

« Credential Acquisition via Registry Hive Dumping Credential Dumping - Prevented - Elastic Endgame »