Florian Roth
98 lines
3.2 KiB
YAML
98 lines
3.2 KiB
YAML
title: Suspicious GrantedAccess Flags on LSASS Access
|
|
id: a18dd26b-6450-46de-8c91-9659150cf088
|
|
related:
|
|
- id: 32d0d3e2-e58d-4d41-926b-18b520b2b32d
|
|
type: obsoletes
|
|
status: experimental
|
|
description: Detects process access to LSASS memory with suspicious access flags
|
|
author: Florian Roth
|
|
date: 2021/11/22
|
|
references:
|
|
- https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
|
|
- https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
|
|
- https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
|
|
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
|
|
- http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
|
|
tags:
|
|
- attack.credential_access
|
|
- attack.t1003.001
|
|
- attack.t1003 # an old one
|
|
- attack.s0002
|
|
logsource:
|
|
category: process_access
|
|
product: windows
|
|
detection:
|
|
selection:
|
|
TargetImage|endswith: '\lsass.exe'
|
|
GrantedAccess|endswith:
|
|
- '10'
|
|
- '30'
|
|
- '50'
|
|
- '70'
|
|
- '90'
|
|
- 'B0'
|
|
- 'D0'
|
|
- 'F0'
|
|
- '18'
|
|
- '38'
|
|
- '58'
|
|
- '78'
|
|
- '98'
|
|
- 'B8'
|
|
- 'D8'
|
|
- 'F8'
|
|
- '1A'
|
|
- '3A'
|
|
- '5A'
|
|
- '7A'
|
|
- '9A'
|
|
- 'BA'
|
|
- 'DA'
|
|
- 'FA'
|
|
# Absolute paths to programs that cause false positives
|
|
filter1:
|
|
SourceImage:
|
|
- 'C:\WINDOWS\system32\taskmgr.exe'
|
|
- 'C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe'
|
|
- 'C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe'
|
|
# Windows Defender
|
|
filter2:
|
|
SourceImage|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
|
|
SourceImage|endswith: '\MsMpEng.exe'
|
|
# Microsoft Gaming Services
|
|
filter3:
|
|
SourceImage|startswith: 'C:\Program Files\WindowsApps\'
|
|
SourceImage|endswith: '\GamingServices.exe'
|
|
GrantedAccess: '0x1410'
|
|
# Process Explorer
|
|
filter4:
|
|
SourceImage|endswith:
|
|
- '\PROCEXP64.EXE'
|
|
- '\PROCEXP.EXE'
|
|
GrantedAccess: '0x1410'
|
|
# VMware Tools
|
|
filter5:
|
|
SourceImage|startswith: 'C:\ProgramData\VMware\VMware Tools\'
|
|
SourceImage|endswith: '\vmtoolsd.exe'
|
|
# Antivirus and EDR agents
|
|
filter6:
|
|
SourceImage|startswith:
|
|
- 'C:\Progra Files\'
|
|
- 'C:\Progra Files (x86)\'
|
|
SourceImage|contains:
|
|
- 'Antivirus'
|
|
# Generic Filter for 0x1410 filter (caused by so many programs like DropBox updates etc.)
|
|
filter_generic:
|
|
SourceImage|startswith:
|
|
- 'C:\Program Files\'
|
|
- 'C:\Program Files (x86)\'
|
|
GrantedAccess: '0x1410'
|
|
condition: selection and not filter1 and not filter2 and not filter3 and not filter4 and not filter5 and not filter6 and not filter_generic
|
|
fields:
|
|
- User
|
|
- SourceImage
|
|
- GrantedAccess
|
|
falsepositives:
|
|
- Legitimate software accessing LSASS process for legitimate reason
|
|
level: high
|