SigmaHQ/rules/windows/builtin/win_susp_lsass_dump.yml

title: Password Dumper Activity on LSASS
description: Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN 
status: experimental
reference: https://twitter.com/jackcr/status/807385668833968128
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4656
        ProcessName: 'C:\Windows\System32\lsass.exe'
        AccessMask: '0x705'
        ObjectType: 'SAM_DOMAIN'
    condition: selection
falsepositives:
    - Unkown
level: high
New rules and cleanup 2017-02-12 14:50:39 +00:00			`title: Password Dumper Activity on LSASS`
			`description: Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN`
			`status: experimental`
			`reference: https://twitter.com/jackcr/status/807385668833968128`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`logsource:`
Removed lists from log source section 2017-02-19 10:08:23 +00:00			`product: windows`
Windows Built-In rules > LogSource definition 2017-03-05 22:55:52 +00:00			`service: security`
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`detection:`
			`selection:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`EventID: 4656`
			`ProcessName: 'C:\Windows\System32\lsass.exe'`
			`AccessMask: '0x705'`
			`ObjectType: 'SAM_DOMAIN'`
Renamed rule files, new rules 2017-02-10 18:17:02 +00:00			`condition: selection`
			`falsepositives:`
New rules and cleanup 2017-02-12 14:50:39 +00:00			`- Unkown`
Levels to low, medium, high, critical 2017-02-16 17:02:26 +00:00			`level: high`
Removed lists from log source section 2017-02-19 10:08:23 +00:00