Detects OS credential dumping techniques like LSASS access, SAM extraction, NTDS, and DCSync using EDR telemetry and Sysmon logs. Useful for threat hunting and incident response in Windows environments.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 在受攻击环境中主动狩猎后渗透凭据盗取活动时
Detects T1003 credential dumping attacks on LSASS, SAM, NTDS.dit, cached creds using EDR telemetry, Sysmon process access, Windows security events. For threat hunting and incident response.
Detects credential dumping (T1003) targeting LSASS, SAM, NTDS.dit, cached creds via EDR telemetry, Sysmon process access, Windows event correlation. For threat hunting and IR.
Detects credential dumping attacks (T1003) targeting LSASS memory, SAM, NTDS.dit, cached credentials via EDR telemetry, Sysmon ProcessAccess, Windows events. For threat hunting and incident response.
Share bugs, ideas, or general feedback.
| 概念 | 描述 |
|---|---|
| T1003 | 操作系统凭据转储（OS Credential Dumping）——父技术 |
| T1003.001 | LSASS 内存——从 LSASS 进程转储凭据 |
| T1003.002 | 安全账户管理器（SAM）——提取本地密码哈希 |
| T1003.003 | NTDS——从域控制器提取 AD 数据库 |
| T1003.004 | LSA Secrets——访问存储的服务凭据 |
| T1003.005 | 缓存的域凭据（DCC2） |
| T1003.006 | DCSync——通过 DRSUAPI 复制 AD 凭据 |
| LSASS | 本地安全授权子系统服务（Local Security Authority Subsystem Service） |
| GrantedAccess | 表示进程请求访问权限的位掩码 |
| Minidump | comsvcs.dll 等工具使用的内存转储技术 |
| 工具 | 用途 |
|---|---|
| CrowdStrike Falcon | LSASS 访问检测和进程树分析 |
| Microsoft Defender for Endpoint | 凭据访问事件的高级狩猎 |
| Sysmon | 进程访问监控（事件 ID 10） |
| Velociraptor | LSASS 分析的终端工件收集 |
| Elastic Security | 凭据转储指标的关联分析 |
| Splunk | 凭据访问事件分析的 SPL 查询 |
| Volatility | LSASS 凭据提取的内存取证 |
sekurlsa::logonpasswords，导致直接 LSASS 内存读取，GrantedAccess 为 0x1010。rundll32.exe comsvcs.dll MiniDump [LSASS PID] 创建 LSASS 内存转储文件。-ma lsass.exe 参数转储 LSASS 内存。reg save HKLM\SAM sam.bak 提取本地密码哈希。vssadmin create shadow /for=C: 然后从卷影副本复制 ntds.dit。Hunt ID: TH-CRED-DUMP-[DATE]-[SEQ]
Technique: T1003.[子技术]
Source Process: [访问 LSASS/SAM/NTDS 的进程]
Target: [lsass.exe / SAM / NTDS.dit / DC 复制]
Host: [主机名]
User: [账户上下文]
GrantedAccess: [访问掩码（如适用）]
Timestamp: [UTC]
Risk Level: [Critical/High/Medium/Low]
Evidence: [日志条目、进程树、网络活动]
Recommended Action: [密码重置范围、遏制步骤]