SigmaHQ/rules/windows/sysmon/sysmon_password_dumper_lsass.yml

title: Password Dumper Remote Thread in LSASS 
description: Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundrets of events.
author: Thomas Patzke
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 8
        TargetProcess: 'C:\Windows\System32\lsass.exe'
        StartModule: null
    condition: selection
falsepositives:
    - unknown
level: high
LSASS Remote Thread Update 2017-02-12 15:33:09 +00:00			`title: Password Dumper Remote Thread in LSASS`
			`description: Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundrets of events.`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`author: Thomas Patzke`
			`logsource:`
Sysmon as 'service' of product 'windows' 2017-03-13 08:23:08 +00:00			`product: windows`
			`service: sysmon`
New rules and cleanup 2017-02-12 14:50:39 +00:00			`detection:`
			`selection:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`EventID: 8`
			`TargetProcess: 'C:\Windows\System32\lsass.exe'`
Added proper handling of null/not null values Fixes issue #25 2017-10-29 22:57:39 +00:00			`StartModule: null`
New rules and cleanup 2017-02-12 14:50:39 +00:00			`condition: selection`
			`falsepositives:`
			`- unknown`
Levels to low, medium, high, critical 2017-02-16 17:02:26 +00:00			`level: high`
LSASS Remote Thread Update 2017-02-12 15:33:09 +00:00