Detects T1003 credential dumping attacks on LSASS, SAM, NTDS.dit, cached creds using EDR telemetry, Sysmon process access, Windows security events. For threat hunting and incident response.
npx claudepluginhub killvxk/cybersecurity-skills-zhThis skill uses the workspace's default tool permissions.
- 狩猎环境中的凭据窃取活动时
Detects OS credential dumping techniques like LSASS access, SAM extraction, NTDS, and DCSync using EDR telemetry and Sysmon logs. Useful for threat hunting and incident response in Windows environments.
Detects credential dumping (T1003) targeting LSASS, SAM, NTDS.dit, cached creds via EDR telemetry, Sysmon process access, Windows event correlation. For threat hunting and IR.
Detects credential dumping attacks (T1003) targeting LSASS memory, SAM, NTDS.dit, cached credentials via EDR telemetry, Sysmon ProcessAccess, Windows events. For threat hunting and incident response.
Share bugs, ideas, or general feedback.
| 概念 | 描述 |
|---|---|
| T1003.001 | LSASS 内存——从 LSASS 进程转储凭据 |
| T1003.002 | 安全账户管理器——从 SAM 提取本地账户哈希 |
| T1003.003 | NTDS——从 Active Directory 数据库提取域哈希 |
| T1003.004 | LSA 机密——提取服务账户密码 |
| T1003.005 | 缓存域凭据——提取 DCC2 哈希 |
| T1003.006 | DCSync——从域控制器复制凭据 |
| 凭据保护（Credential Guard） | 基于虚拟化的 LSASS 机密隔离 |
| RunAsPPL | LSASS 受保护进程轻量级模式 |
index=sysmon EventCode=10
| where match(TargetImage, "(?i)lsass\.exe$")
| where GrantedAccess IN ("0x1FFFFF", "0x1F3FFF", "0x143A", "0x1F0FFF", "0x0040", "0x1010", "0x1410")
| where NOT match(SourceImage, "(?i)(csrss|lsass|svchost|MsMpEng|WmiPrvSE|taskmgr|procexp|SecurityHealthService)\.exe$")
| table _time Computer SourceImage SourceProcessId GrantedAccess CallTrace
index=sysmon EventCode=1
| where match(CommandLine, "(?i)(sekurlsa|lsadump|kerberos::list|crypto::certificates)")
OR match(CommandLine, "(?i)procdump.*-ma.*lsass")
OR match(CommandLine, "(?i)comsvcs\.dll.*MiniDump")
OR match(CommandLine, "(?i)ntdsutil.*\"ac i ntds\".*ifm")
OR match(CommandLine, "(?i)reg\s+save\s+hklm\\\\(sam|security|system)")
OR match(CommandLine, "(?i)vssadmin.*create\s+shadow")
| table _time Computer User Image CommandLine ParentImage
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType in ("LsassAccess", "CredentialDumpingActivity")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
InitiatingProcessCommandLine, ActionType, AdditionalFields
| sort by Timestamp desc
title: LSASS Memory Credential Dumping Attempt
status: stable
logsource:
product: windows
category: process_access
detection:
selection:
TargetImage|endswith: '\lsass.exe'
GrantedAccess|contains:
- '0x1FFFFF'
- '0x1F3FFF'
- '0x143A'
- '0x0040'
filter:
SourceImage|endswith:
- '\csrss.exe'
- '\lsass.exe'
- '\MsMpEng.exe'
- '\svchost.exe'
condition: selection and not filter
level: critical
tags:
- attack.credential_access
- attack.t1003.001
sekurlsa::logonpasswords 直接读取 LSASS 内存，提取明文密码、NTLM 哈希和 Kerberos 票据。procdump.exe -ma lsass.exe lsass.dmp 创建内存转储供离线凭据提取。rundll32.exe comsvcs.dll MiniDump [LSASS_PID] dump.bin full 利用内置 Windows DLL 转储 LSASS。reg save HKLM\SAM sam.save 结合 reg save HKLM\SYSTEM system.save 进行本地账户哈希提取。Hunt ID: TH-CRED-[DATE]-[SEQ]
Host: [主机名]
Dumping Method: [LSASS_Access/NTDS/SAM/DCSync]
Source Process: [使用的工具或进程]
Target: [LSASS/NTDS.dit/SAM/SECURITY]
Access Rights: [授予的访问掩码]
User Context: [执行转储的账户]
ATT&CK Technique: [T1003.00x]
Risk Level: [Critical/High/Medium]
Credentials at Risk: [影响范围评估]