Detecting T1003 Credential Dumping With Edr | Skills Pool
技能檔案
Detecting T1003 Credential Dumping With Edr
Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.
When hunting for credential theft activity in the environment
After compromise indicators suggest attacker has elevated privileges
When EDR alerts fire for LSASS access or suspicious process memory reads
During incident response to determine scope of credential compromise
When auditing LSASS protection controls (Credential Guard, RunAsPPL)
Prerequisites
EDR agent deployed with LSASS access monitoring (CrowdStrike, Defender for Endpoint, SentinelOne)
Sysmon Event ID 10 (ProcessAccess) with LSASS-specific filters
Windows Security Event ID 4656/4663 (Object Access Auditing)
LSASS SACL auditing enabled (Windows 10+)
Registry auditing for SAM hive access
Workflow
Monitor LSASS Process Access: Track all processes opening handles to lsass.exe with suspicious access rights (PROCESS_VM_READ 0x0010, PROCESS_ALL_ACCESS 0x1FFFFF). Non-privileged or unusual processes accessing LSASS are strong indicators.
相關技能
Detect Credential Dumping Tools: Hunt for known tool signatures -- Mimikatz (sekurlsa::logonpasswords), procdump.exe targeting LSASS, comsvcs.dll MiniDump, and Task Manager creating LSASS dumps.
Monitor NTDS.dit Access: Detect Volume Shadow Copy creation (vssadmin, wmic shadowcopy) followed by NTDS.dit file access, or ntdsutil.exe IFM creation.
Track SAM/SECURITY/SYSTEM Hive Access: Hunt for reg.exe save commands targeting SAM, SECURITY, and SYSTEM registry hives.
Detect DCSync Activity: Monitor for non-DC accounts requesting directory replication (Event 4662 with replication GUIDs).
Correlate with Lateral Movement: After credential dumping, attackers typically move laterally. Correlate credential access events with subsequent remote logon attempts.
Assess Impact: Determine which credentials were potentially compromised and initiate password resets.
Key Concepts
Concept
Description
T1003.001
LSASS Memory -- dumping credentials from LSASS process
T1003.002
Security Account Manager -- extracting local account hashes from SAM
T1003.003
NTDS -- extracting domain hashes from Active Directory database
T1003.004
LSA Secrets -- extracting service account passwords
DCSync -- replicating credentials from domain controller
Credential Guard
Virtualization-based isolation of LSASS secrets
RunAsPPL
Protected Process Light for LSASS
Detection Queries
Splunk -- LSASS Access Detection
index=sysmon EventCode=10
| where match(TargetImage, "(?i)lsass\.exe$")
| where GrantedAccess IN ("0x1FFFFF", "0x1F3FFF", "0x143A", "0x1F0FFF", "0x0040", "0x1010", "0x1410")
| where NOT match(SourceImage, "(?i)(csrss|lsass|svchost|MsMpEng|WmiPrvSE|taskmgr|procexp|SecurityHealthService)\.exe$")
| table _time Computer SourceImage SourceProcessId GrantedAccess CallTrace
Splunk -- Credential Dumping Tool Detection
index=sysmon EventCode=1
| where match(CommandLine, "(?i)(sekurlsa|lsadump|kerberos::list|crypto::certificates)")
OR match(CommandLine, "(?i)procdump.*-ma.*lsass")
OR match(CommandLine, "(?i)comsvcs\.dll.*MiniDump")
OR match(CommandLine, "(?i)ntdsutil.*\"ac i ntds\".*ifm")
OR match(CommandLine, "(?i)reg\s+save\s+hklm\\\\(sam|security|system)")
OR match(CommandLine, "(?i)vssadmin.*create\s+shadow")
| table _time Computer User Image CommandLine ParentImage
KQL -- Microsoft Defender for Endpoint
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType in ("LsassAccess", "CredentialDumpingActivity")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
InitiatingProcessCommandLine, ActionType, AdditionalFields
| sort by Timestamp desc