LSASS Process Memory Dump Files

    Wednesday, October 9, 2024 In: Threat Research Print

    Date: 10/09/2024

    Severity: Medium

    Summary

    "LSASS Process Memory Dump Files" refer to the memory dumps created from the Local Security Authority Subsystem Service (LSASS) process in Windows. LSASS is responsible for enforcing security policies, managing user logins, and handling password verification. Analyzing LSASS memory dumps can reveal sensitive information, such as credentials and authentication tokens, making them a target for attackers seeking to steal user credentials. Therefore, securing LSASS and monitoring for unauthorized access to its memory is crucial for maintaining system security and preventing credential theft.

    Indicators of Compromise (IOC) List

    TargetFilename

    '\Andrew.dmp'

    '\Coredump.dmp'

    '\lsass.dmp'

    '\lsass.rar'

    '\lsass.zip'

    '\NotLSASS.zip'

    '\PPLBlade.dmp'

    '\rustive.dmp'

    '\lsass_2'  

    '\lsassdmp'

    '\lsassdump'

    '\lsass'

    '.dmp'

    'SQLDmpr'

    '.mdmp'

    '\nanodump'

    '\proc_'

    '.dmp'

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1

    (resourcename in ("Sysmon") AND eventtype = "11") AND targetfilename IN ("\Andrew.dmp","\Coredump.dmp","\lsass.dmp","\lsass.rar","\lsass.zip","\NotLSASS.zip","\PPLBlade.dmp","\rustive.dmp","\lsass_2","\lsassdmp","\lsassdump","\lsass",".dmp","SQLDmpr",".mdmp","\nanodump","\proc_",".dmp")

    Detection Query 2

    (technologygroup = "EDR") AND targetfilename IN ("\Andrew.dmp","\Coredump.dmp","\lsass.dmp","\lsass.rar","\lsass.zip","\NotLSASS.zip","\PPLBlade.dmp","\rustive.dmp","\lsass_2","\lsassdmp","\lsassdump","\lsass",".dmp","SQLDmpr",".mdmp","\nanodump","\proc_",".dmp")

    Detection Query 3

    (resourcename in ("Windows Security") AND eventtype = "4663") AND winmessage IN ("\Andrew.dmp","\Coredump.dmp","\lsass.dmp","\lsass.rar","\lsass.zip","\NotLSASS.zip","\PPLBlade.dmp","\rustive.dmp","\lsass_2","\lsassdmp","\lsassdump","\lsass",".dmp","SQLDmpr",".mdmp","\nanodump","\proc_",".dmp")

    Detection Query 4

    (technologygroup = "EDR") AND winmessage IN ("\Andrew.dmp","\Coredump.dmp","\lsass.dmp","\lsass.rar","\lsass.zip","\NotLSASS.zip","\PPLBlade.dmp","\rustive.dmp","\lsass_2","\lsassdmp","\lsassdump","\lsass",".dmp","SQLDmpr",".mdmp","\nanodump","\proc_",".dmp")

    Reference: 

    https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml


    Tags

    MalwareSigmaCredentialTheft

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2024 by Gurucul - All rights reserved.