LSASS Memory dump via MiniDumpWriteDump

[rule]
description = """
Identifies attempt to access the Local Security Authority Subsystem Service (LSASS) to dump its memory using the Windows
API MiniDumpWritedump. Adversaries may attempt to access credential material stored in the process memory of LSASS.
"""
id = "bdf280ea-d4d7-4f8f-90fc-0f44edad6b87"
license = "Elastic License v2"
name = "LSASS Memory dump via MiniDumpWriteDump"
os_list = ["windows"]
version = "1.0.16"

query = '''
credential_access where
 Target.process.name : "lsass.exe" and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.module_path : ("*dbgcore.dll*", "*comsvcs.dll*")) and 
 not (process.Ext.api.name : "OpenThread" and user.id == "S-1-5-18" and 
      process.executable : "?:\\Windows\\System32\\WerFault.exe" and process.thread.Ext.call_stack_contains_unbacked == false) and
 not (process.executable : ("C:\\Windows\\System32\\WerFaultSecure.exe", "C:\\Windows\\System32\\WerFault.exe") and
      process.Ext.api.parameters.desired_access_numeric == 2097151 and process.thread.Ext.call_stack_contains_unbacked == false)
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.7.0"