LSASS Access Attempt from Unbacked Memory

[rule]
description = """
Identifies attempt to access the Local Security Authority Subsystem Service (LSASS) and from a call stack containing
unbacked code. Adversaries may attempt to access credential material stored in the process memory of LSASS.
"""
id = "03efdaab-72af-4714-83ce-3abc10cab8d5"
license = "Elastic License v2"
name = "LSASS Access Attempt from Unbacked Memory"
os_list = ["windows"]
version = "1.0.17"

query = '''
sequence by process.entity_id with maxspan=3m
[process where event.action == "start" and
  process.parent.name != null and
 (
   process.executable : ("?:\\Windows\\system32\\*", "?:\\Windows\\SysWOW64\\*") or
   process.parent.executable : "?:\\Windows\\system32\\wsmprovhost.exe" or
   process.executable regex~ """c:\\windows\\[a-z0-9\-\_\.]+\.exe"""
  ) and
  not (process.executable : "?:\\Windows\\system32\\svchost.exe" and process.parent.name : "services.exe") and
  not (process.executable : "?:\\Windows\\System32\\MRT.exe" and process.parent.executable : "?:\\Windows\\SoftwareDistribution\\*.exe") and
  process.Ext.protection != "PsProtectedSignerAntimalware-Light" and
  not (process.executable : "?:\\Windows\\System32\\msiexec.exe" and process.args : "/V") and
  not (process.parent.executable : "?:\\Windows\\System32\\msiexec.exe" and process.parent.args : "/V") and
  not (process.executable : ("?:\\Windows\\System32\\wbem\\WmiPrvSE.exe", "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe") and
       process.args : "-Embedding" and process.parent.name : "svchost.exe") and
  not (process.executable : "?:\\Windows\\system32\\netstat.exe" and user.id == "S-1-5-18" and process.args : ("-a", "/a")) and
  not (process.executable : "?:\\Windows\\system32\\tasklist.exe" and process.args : "/M") and
  not (process.name : "powershell.exe" and process.args : "'C:\\ProgramData\\CentraStage\\AEMAgent\\Temp\\*.ps1'" and
   process.parent.executable : "C:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe") and
  not (user.id == "S-1-5-18" and process.executable : "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" and
       process.parent.command_line : ("cmd /c \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -File -\"",
                                      "cmd /d /c \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NonInteractive -NoProfile -ExecutionPolicy Bypass -File -\"") and
       process.working_directory : ("C:\\Program Files (x86)\\Tanium\\Tanium Client\\extensions\\comply\\data\\results\\*", "c:\\Program Files\\Nodeware\\"))
]
[credential_access where
  Target.process.name : "lsass.exe" and
  process.thread.Ext.call_stack_contains_unbacked == true and
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.module_path : ("?:\\Program Files\\*",
                                         "?:\\Program Files (x86)\\*",
                                         "?:\\Windows\\assembly\\NativeImages*",
                                         "?:\\Windows\\System32\\DriverStore*"))]
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.7.0"