| id | WIN-170105221010 |
| author | Roberto Rodriguez @Cyb3rWard0g |
| creation date | 2017/01/05 |
| platform | Windows |
| playbook link | WIN-1904101010 |
After a user logs on, a variety of credentials are generated and stored in the Local Security Authority Subsystem Service (LSASS) process in memory. This is meant to facilitate single sign-on (SSO) ensuring a user isn’t prompted each time resource access is requested. The credential data may include Kerberos tickets, NTLM password hashes, LM password hashes (if the password is <15 characters, depending on Windows OS version and patch level), and even clear-text passwords (to support WDigest and SSP authentication among others. Adversaries look to get access to the credential data and do it so by finding a way to access the contents of memory of the LSASS process. For example, tools like Mimikatz get credential data by listing all available provider credentials with its SEKURLSA::LogonPasswords module. The module uses a Kernel32 function called OpenProcess to get a handle to lsass to then access LSASS and dump password data for currently logged on (or recently logged on) accounts as well as services running under the context of user credentials. Even though most adversaries might inject into a System process to blend in with most applications accessing LSASS, there are ocassions where adversaries do not elevate to System and use the available administrator rights from the user since that is the minimum requirement to access LSASS.
In [ ]:
from openhunt.mordorutils import *
spark = get_spark()
In [ ]:
mordor_file = "https://raw.githubusercontent.com/hunters-forge/mordor/master/small_datasets/windows/credential_access/credential_dumping_T1003/credentials_from_memory/empire_mimikatz_logonpasswords.tar.gz"
registerMordorSQLTable(spark, mordor_file, "mordorTable")
| FP Rate | Log Channel | Description |
|---|---|---|
| Low | ['Security'] | Look for non-system accounts getting a handle and access lsass |
In [ ]:
df = spark.sql(
'''
SELECT `@timestamp`, computer_name, SubjectUserName, ProcessName, ObjectName, AccessMask, event_id
FROM mordorTable
WHERE channel = "Security"
AND (event_id = 4663 OR event_id = 4656)
AND ObjectName LIKE "%lsass.exe"
AND NOT SubjectUserName LIKE "%$"
'''
)
df.show(1,False)
| FP Rate | Log Channel | Description |
|---|---|---|
| Medium | ['Microsoft-Windows-Sysmon/Operational'] | Processes opening handles and accessing Lsass with potential dlls in memory (i.e UNKNOWN in CallTrace) |
In [ ]:
df = spark.sql(
'''
SELECT `@timestamp`, computer_name, SourceImage, TargetImage, GrantedAccess, SourceProcessGUID
FROM mordorTable
WHERE channel = "Microsoft-Windows-Sysmon/Operational"
AND event_id = 10
AND TargetImage LIKE "%lsass.exe"
AND CallTrace LIKE "%UNKNOWN%"
'''
)
df.show(1,False)
| FP Rate | Log Channel | Description |
|---|---|---|
| Medium | ['Microsoft-Windows-Sysmon/Operational'] | Look for processes loading a few known DLLs loaded by tools like Mimikatz to interact with credentials |
In [ ]:
df = spark.sql(
'''
SELECT ProcessGuid,Image, COUNT(DISTINCT ImageLoaded) AS hits
FROM mordorTable
WHERE channel = "Microsoft-Windows-Sysmon/Operational"
AND event_id = 7
AND (
ImageLoaded LIKE "%samlib.dll"
OR ImageLoaded LIKE "%vaultcli.dll"
OR ImageLoaded LIKE "%hid.dll"
OR ImageLoaded LIKE "%winscard.dll"
OR ImageLoaded LIKE "%cryptdll.dll"
)
AND `@timestamp` BETWEEN "2019-03-00 00:00:00.000" AND "2019-06-20 00:00:00.000"
GROUP BY ProcessGuid,Image ORDER BY hits DESC LIMIT 10
'''
)
df.show(1,False)
| FP Rate | Log Channel | Description |
|---|---|---|
| Medium | ['Microsoft-Windows-Sysmon/Operational'] | Join processes opening a handle and accessing LSASS with potential DLLs loaded in memory and processes loading a few known DLLs loaded by tools like Mimikatz to interact with credentials |
In [ ]:
df = spark.sql(
'''
SELECT a.`@timestamp`, a.computer_name, m.Image, a.SourceProcessGUID
FROM mordorTable a
INNER JOIN (
SELECT ProcessGuid,Image, COUNT(DISTINCT ImageLoaded) AS hits
FROM mordorTable
WHERE channel = "Microsoft-Windows-Sysmon/Operational"
AND event_id = 7
AND (
ImageLoaded LIKE "%samlib.dll"
OR ImageLoaded LIKE "%vaultcli.dll"
OR ImageLoaded LIKE "%hid.dll"
OR ImageLoaded LIKE "%winscard.dll"
OR ImageLoaded LIKE "%cryptdll.dll"
)
AND `@timestamp` BETWEEN "2019-03-00 00:00:00.000" AND "2019-06-20 00:00:00.000"
GROUP BY ProcessGuid,Image ORDER BY hits DESC LIMIT 10
) m
ON a.SourceProcessGUID = m.ProcessGuid
WHERE a.channel = "Microsoft-Windows-Sysmon/Operational"
AND a.event_id = 10
AND a.TargetImage LIKE "%lsass.exe"
AND a.CallTrace LIKE "%UNKNOWN%"
AND m.hits >= 3
'''
)
df.show(1,False)
| FP Rate | Log Channel | Description |
|---|---|---|
| Medium | ['Microsoft-Windows-Sysmon/Operational'] | Join non system accounts creating processes that open handles and access LSASS with potential DLLs loaded in memory and load a few known DLLs loaded by tools like Mimikatz to interact with credentials on ProcessGuid values |
In [ ]:
df = spark.sql(
'''
SELECT p.`@timestamp`, p.computer_name, p.Image, p.User
FROM mordorTable p
INNER JOIN potential_mimikatz m
ON p.ProcessGuid = m.SourceProcessGUID
WHERE p.channel = "Microsoft-Windows-Sysmon/Operational"
AND p.event_id = 1
AND NOT p.LogonId = "0x3e7"
'''
)
df.show(1,False)