<jupyter_start><jupyter_text>Remote Interactive Task Manager LSASS Dump  Metadata |     Metadata      |  Value  ||:------------------|:---|| collaborators     | ['@Cyb3rWard0g', '@Cyb3rPandaH'] || creation date     | 2019/10/30 || modification date | 2020/09/20 || playbook related  | ['WIN-1904101010'] |  HypothesisAdversaries might be RDPing to computers in my environment and interactively dumping the memory contents of LSASS with task manager.  Technical ContextNone  Offensive TradecraftThe Windows Task Manager may be used to dump the memory space of lsass.exe to disk for processing with a credential access tool such as Mimikatz.This is performed by launching Task Manager as a privileged user, selecting lsass.exe, and clicking "Create dump file".This saves a dump file to disk with a deterministic name that includes the name of the process being dumped.  Security Datasets | Metadata  |    Value  ||:----------|:----------|| docs      | https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-191027055035.html        || link      | [https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/credential_access/host/rdp_interactive_taskmanager_lsass_dump.zip](https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/credential_access/host/rdp_interactive_taskmanager_lsass_dump.zip)  |  Analytics  Initialize Analytics Engine<jupyter_code>from openhunt.mordorutils import *
spark = get_spark()<jupyter_output><empty_output><jupyter_text>Download & Process Security Dataset<jupyter_code>sd_file = "https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/credential_access/host/rdp_interactive_taskmanager_lsass_dump.zip"
registerMordorSQLTable(spark, sd_file, "sdTable")<jupyter_output><empty_output><jupyter_text>Analytic ILook for taskmgr creating files which name contains the string lsass and with extension .dmp. | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| File | Microsoft-Windows-Sysmon/Operational | Process created File | 11 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, Image, TargetFilename, ProcessGuid
FROM sdTable
WHERE Channel = "Microsoft-Windows-Sysmon/Operational"
    AND EventID = 11
    AND Image LIKE "%taskmgr.exe"
    AND lower(TargetFilename) RLIKE ".*lsass.*\.dmp"
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic IILook for task manager access lsass and with functions from dbgcore.dll or dbghelp.dll libraries | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Process | Microsoft-Windows-Sysmon/Operational | Process accessed Process | 10 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, SourceImage, TargetImage, GrantedAccess
FROM sdTable
WHERE Channel = "Microsoft-Windows-Sysmon/Operational"
    AND EventID = 10
    AND lower(SourceImage) LIKE "%taskmgr.exe"
    AND lower(TargetImage) LIKE "%lsass.exe"
    AND (lower(CallTrace) RLIKE ".*dbgcore\.dll.*" OR lower(CallTrace) RLIKE ".*dbghelp\.dll.*")
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic IIILook for any process accessing lsass and with functions from dbgcore.dll or dbghelp.dll libraries | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Process | Microsoft-Windows-Sysmon/Operational | Process accessed Process | 10 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, SourceImage, TargetImage, GrantedAccess
FROM sdTable
WHERE Channel = "Microsoft-Windows-Sysmon/Operational"
    AND EventID = 10
    AND lower(TargetImage) LIKE "%lsass.exe"
    AND (lower(CallTrace) RLIKE ".*dbgcore\.dll.*" OR lower(CallTrace) RLIKE ".*dbghelp\.dll.*")
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic IVLook for combinations of process access and process creation to get more context around potential lsass dump form task manager or other binaries | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Process | Microsoft-Windows-Sysmon/Operational | Process accessed Process | 10 || Process | Microsoft-Windows-Sysmon/Operational | Process created Process | 1 |<jupyter_code>df = spark.sql(
'''
SELECT o.`@timestamp`, o.Hostname, o.Image, o.LogonId, o.ProcessGuid, a.SourceProcessGUID, o.CommandLine
FROM sdTable o
INNER JOIN (
    SELECT Hostname,SourceProcessGUID
    FROM sdTable
    WHERE Channel = "Microsoft-Windows-Sysmon/Operational"
        AND EventID = 10
        AND lower(TargetImage) LIKE "%lsass.exe"
        AND (lower(CallTrace) RLIKE ".*dbgcore\.dll.*" OR lower(CallTrace) RLIKE ".*dbghelp\.dll.*")
    ) a
ON o.ProcessGuid = a.SourceProcessGUID
WHERE o.Channel = "Microsoft-Windows-Sysmon/Operational"
    AND o.EventID = 1
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic VLook for binaries accessing lsass that are running under the same logon context of a user over an RDP session | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Process | Microsoft-Windows-Sysmon/Operational | Process accessed Process | 10 || Process | Microsoft-Windows-Sysmon/Operational | Process created Process | 1 || Authentication log | Microsoft-Windows-Security-Auditing | User authenticated Host | 4778 |<jupyter_code>df = spark.sql(
'''
SELECT o.`@timestamp`, o.Hostname, o.SessionName, o.AccountName, o.ClientName, o.ClientAddress, a.Image, a.CommandLine
FROM sdTable o
INNER JOIN (
    SELECT LogonId, Image, CommandLine
    FROM (
        SELECT o.Image, o.LogonId, o.CommandLine
        FROM sdTable o
        INNER JOIN (
            SELECT Hostname,SourceProcessGUID
            FROM sdTable
            WHERE Channel = "Microsoft-Windows-Sysmon/Operational"
                AND EventID = 10
                AND lower(TargetImage) LIKE "%lsass.exe"
                AND (lower(CallTrace) RLIKE ".*dbgcore\.dll.*" OR lower(CallTrace) RLIKE ".*dbghelp\.dll.*")
            ) a
        ON o.ProcessGuid = a.SourceProcessGUID
        WHERE o.Channel = "Microsoft-Windows-Sysmon/Operational"
            AND o.EventID = 1
        )
    ) a
ON o.LogonID = a.LogonId
WHERE lower(o.Channel) = "security"
    AND o.EventID = 4778
'''
)
df.show(10,False)<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.1474091260634184, 'fraction_numerical': 0.012838360402165506, 'mean_word_length': 3.5858156028368793, 'pattern_counts': {'":': 0, '<': 29, '<?xml version=': 0, '>': 29, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '7', 'dir': 'jupyter-structured-clean-dedup', 'id': '532370', 'license': 'MIT', 'n_tokens_mistral': 2028, 'n_tokens_neox': 1871, 'n_words': 502, 'path': 'docs/notebooks/windows/06_credential_access/WIN-191030201010.ipynb', 'repo_name': 'hitenkoku/ThreatHunter-Playbook', 'size': '6465'}