sigmahighHunting

Password Dumper Activity on LSASS

Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN

MITRE ATT&CK

credential-access

Detection Query

selection:
  EventID: 4656
  ProcessName|endswith: \lsass.exe
  AccessMask: "0x705"
  ObjectType: SAM_DOMAIN
condition: selection

Author

sigma

Created

2017-02-12

Data Sources

windowssecurity

Platforms

windows

References

https://twitter.com/jackcr/status/807385668833968128

Tags

attack.credential-accessattack.t1003.001

Raw Content

title: Password Dumper Activity on LSASS
id: aa1697b7-d611-4f9a-9cb2-5125b4ccfd5c
status: test
description: Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN
references:
    - https://twitter.com/jackcr/status/807385668833968128
author: sigma
date: 2017-02-12
modified: 2022-10-09
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4656
        ProcessName|endswith: '\lsass.exe'
        AccessMask: '0x705'
        ObjectType: 'SAM_DOMAIN'
    condition: selection
falsepositives:
    - Unknown
level: high