Elastic Defend high stable eql

LSASS Memory dump via MiniDumpWriteDump

Identifies attempt to access the Local Security Authority Subsystem Service (LSASS) to dump its memory using the Windows API MiniDumpWritedump. Adversaries may attempt to access credential material stored in the process memory of LSASS.

View Source

Detection Logic

credential_access where
 Target.process.name : "lsass.exe" and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.module_path : ("*dbgcore.dll*", "*comsvcs.dll*")) and 
 not (process.Ext.api.name : "OpenThread" and user.id == "S-1-5-18" and 
      process.executable : "?:\\Windows\\System32\\WerFault.exe" and process.thread.Ext.call_stack_contains_unbacked == false) and
 not (process.executable : ("C:\\Windows\\System32\\WerFaultSecure.exe", "C:\\Windows\\System32\\WerFault.exe") and
      process.Ext.api.parameters.desired_access_numeric == 2097151 and process.thread.Ext.call_stack_contains_unbacked == false)

Field Validations

Loading…

Comments (0)

Loading comments...