Detect Credential Dumping through LSASS access

name: Detect Credential Dumping through LSASS access
id: 2c365e57-4414-4540-8dc0-73ab10729996
version: 16
creation_date: '2019-12-11'
modification_date: '2026-10-09'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: |-
    The following analytic detects attempts to read LSASS memory, indicative of credential dumping.
    It leverages Sysmon EventCode 10 and checks for "PROCESS_VM_READ" with query information access on lsass.exe.
data_source:
    - Sysmon EventID 10
search: |-
    `sysmon`
    EventCode=10
    TargetImage="*\\lsass.exe"

    ```
    Convert GrantedAccess from hexadecimal to decimal.
    Match "PROCESS_VM_READ" with either "PROCESS_QUERY_LIMITED_INFORMATION" or "PROCESS_QUERY_INFORMATION", which represent the either the "0x1010" or "0x1410" hexadecimal masks.
    ```
    | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16)
    | eval PROCESS_VM_READ = 16
    | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096
    | eval PROCESS_QUERY_INFORMATION = 1024
    | eval vm_read_set = bit_and(g_access_decimal, PROCESS_VM_READ)
    | eval query_limited_set = bit_and(g_access_decimal, PROCESS_QUERY_LIMITED_INFORMATION)
    | eval query_information_set = bit_and(g_access_decimal, PROCESS_QUERY_INFORMATION)
    | where vm_read_set == PROCESS_VM_READ
      AND query_limited_set == PROCESS_QUERY_LIMITED_INFORMATION
      AND (query_information_set == 0 OR query_information_set == PROCESS_QUERY_INFORMATION)

    | stats count min(_time) as firstTime
                    max(_time) as lastTime
        BY user_id dest
           signature_id signature granted_access Opcode
           SourceImage SourceProcessGUID SourceProcessId
           TargetImage TargetProcessGUID TargetProcessId
           CallTrace vendor_product

    | eval CallTrace=split(CallTrace, "|")

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_credential_dumping_through_lsass_access_filter`
how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
known_false_positives: The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.
references:
    - https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/
    - https://attack.mitre.org/techniques/T1003/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1003.001/T1003.001.yaml#L5
drilldown_searches:
    - name: View the detection results for - "$dest$" and "$TargetImage$"
      search: '%original_detection_search% | search  dest = "$dest$" TargetImage = "$TargetImage$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$" and "$TargetImage$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$TargetImage$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: The process [$SourceImage$] requested read access via the access mask [$granted_access$] to [$TargetImage$] on [$dest$], which may indicate credential dumping.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: SourceImage
      type: file_path
analytic_story:
    - Detect Zerologon Attack
    - CISA AA23-347A
    - Credential Dumping
    - BlackSuit Ransomware
    - Lokibot
    - Scattered Lapsus$ Hunters
asset_type: Windows
atomic_guid:
    - 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8
mitre_attack_id:
    - T1003.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog
      test_type: unit