lsass-credential-dumping

id: a50138af-4bad-4615-9e55-ced36a836806
name: lsass-credential-dumping
description: |
  This query looks for signs of credential dumping based on process activity instead of targeting process names.
  Author: Jouni Mikkola
  More info: https://threathunt.blog/lsass-credential-dumping/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
  - DeviceFileEvents
tactics:
- CredentialAccess
relevantTechniques:
  - T1003.001
query: |
  let lookuptime = 30d;
  DeviceEvents
  | where Timestamp >ago(lookuptime)
  | where ActionType == "OpenProcessApiCall"
  | where FileName =~ "lsass.exe"
  | project ApiCallTimestamp = Timestamp, InitiatingProcessFileName=tolower(InitiatingProcessFileName), InitiatingProcessCommandLine=tolower(InitiatingProcessCommandLine), InitiatingProcessId, InitiatingProcessCreationTime=tolower(InitiatingProcessCreationTime), InitiatingProcessParentFileName=tolower(InitiatingProcessParentFileName)
  | join (
  DeviceFileEvents
  | where ActionType == "FileCreated"
  | where Timestamp >ago(lookuptime)
  | project FileEventTimestamp = Timestamp, InitiatingProcessFileName=tolower(InitiatingProcessFileName), InitiatingProcessCommandLine=tolower(InitiatingProcessCommandLine), InitiatingProcessId, InitiatingProcessCreationTime=tolower(InitiatingProcessCreationTime), InitiatingProcessParentFileName=tolower(InitiatingProcessParentFileName), FileActionType = ActionType, FilePath = FolderPath, ModifiedFileName = FileName
  ) on InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime
  | where FileEventTimestamp between (ApiCallTimestamp .. (ApiCallTimestamp + 1m))
  | project ApiCallTimestamp, FileEventTimestamp, FilePath,FileActionType, ModifiedFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessParentFileName