[New Rule] Lsass Process Access - Generic

[Samirbous]

using Elastic 8.7 endpoint OpenProcess api events :

any where event.category  == "api" and 
 process.Ext.api.name in ("OpenProcess", "OpenThread") and  Target.process.name == "lsass.exe" and 

Event example :

{
  "_index": ".ds-logs-endpoint.events.api-default-2023.03.02-000001",
  "_id": "lV9rooYBV0oJWcxQo5xn",
  "_score": 1,
  "fields": {
    "host.os.full.text": [
      "Windows Server 2016 Datacenter 1607 (10.0.14393.4467)"
    ],
    "event.category": [
      "api"
    ],
    "process.name.text": [
      "nanodump.x64.exe"
    ],
    "host.os.name.text": [
      "Windows"
    ],
    "host.os.full": [
      "Windows Server 2016 Datacenter 1607 (10.0.14393.4467)"
    ],
    "host.hostname": [
      "01566s-win16-ir"
    ],
    "process.pid": [
      4984
    ],
    "Target.process.pid": [
      724
    ],
    "host.mac": [
      "00:50:56:24:6c:d2"
    ],
    "elastic.agent.id": [
      "39b71dca-3f91-4026-95f1-27fbafaf93b1"
    ],
    "process.thread.Ext.call_stack_contains_unbacked": [
      false
    ],
    "host.os.version": [
      "1607 (10.0.14393.4467)"
    ],
    "host.os.name": [
      "Windows"
    ],
    "host.name": [
      "01566s-win16-ir"
    ],
    "event.agent_id_status": [
      "verified"
    ],
    "event.kind": [
      "event"
    ],
    "event.outcome": [
      "unknown"
    ],
    "process.thread.Ext.call_stack.instruction_pointer": [
      "140702776694495",
      "140702776697750",
      "140702776705210",
      "140702776693697",
      "140702776694006",
      "140722816189652",
      "140722853255041"
    ],
    "host.os.type": [
      "windows"
    ],
    "user.id": [
      "S-1-5-21-308926384-506822093-3341789130-1105"
    ],
    "process.Ext.ancestry": [
      "MzliNzFkY2EtM2Y5MS00MDI2LTk1ZjEtMjdmYmFmYWY5M2IxLTQ3NjQtMTY3Nzc2MTEwMC4xMzIxMjAxMDA=",
      "MzliNzFkY2EtM2Y5MS00MDI2LTk1ZjEtMjdmYmFmYWY5M2IxLTkyMzItMTY3Nzc2MDc4NS4yMjc0MTQxMDA=",
      "MzliNzFkY2EtM2Y5MS00MDI2LTk1ZjEtMjdmYmFmYWY5M2IxLTkyMC0xNjc3NzYwMzkxLjc1NjEyMjAwMA==",
      "MzliNzFkY2EtM2Y5MS00MDI2LTk1ZjEtMjdmYmFmYWY5M2IxLTcwOC0xNjc3NzYwMzg4Ljk3MzQ5MTMwMA==",
      "MzliNzFkY2EtM2Y5MS00MDI2LTk1ZjEtMjdmYmFmYWY5M2IxLTU2OC0xNjc3NzYwMzg4LjczMTIwNzMwMA=="
    ],
    "process.Ext.api.parameters.desired_access": [
      "PROCESS_QUERY_INFORMATION",
      "PROCESS_QUERY_LIMITED_INFORMATION",
      "PROCESS_VM_READ"
    ],
    "data_stream.type": [
      "logs"
    ],
    "host.architecture": [
      "x86_64"
    ],
    "process.name": [
      "nanodump.x64.exe"
    ],
    "agent.id": [
      "39b71dca-3f91-4026-95f1-27fbafaf93b1"
    ],
    "ecs.version": [
      "1.11.0"
    ],
    "event.created": [
      "2023-03-02T13:03:20.247Z"
    ],
    "agent.version": [
      "8.7.0"
    ],
    "host.os.family": [
      "windows"
    ],
    "process.thread.id": [
      6056
    ],
    "user.name": [
      "jbrown"
    ],
    "process.Ext.api.name": [
      "OpenProcess"
    ],
    "process.entity_id": [
      "MzliNzFkY2EtM2Y5MS00MDI2LTk1ZjEtMjdmYmFmYWY5M2IxLTQ5ODQtMTY3Nzc2MjIwMC4yNDcwMDUwMDA="
    ],
    "process.executable.caseless": [
      "c:\\users\\public\\nanodump.x64.exe"
    ],
    "host.ip": [
      "172.16.66.36",
      "127.0.0.1",
      "::1",
      "fe80::ffff:ffff:fffe",
      "fe80::5efe:ac10:4224"
    ],
    "event.sequence": [
      37398
    ],
    "agent.type": [
      "endpoint"
    ],
    "process.executable.text": [
      "C:\\Users\\Public\\nanodump.x64.exe"
    ],
    "event.module": [
      "endpoint"
    ],
    "host.os.kernel": [
      "1607 (10.0.14393.4467)"
    ],
    "host.os.full.caseless": [
      "windows server 2016 datacenter 1607 (10.0.14393.4467)"
    ],
    "user.domain": [
      "3B"
    ],
    "process.name.caseless": [
      "nanodump.x64.exe"
    ],
    "host.id": [
      "83989f29-8447-4b3c-a54b-4a0f7e5a4872"
    ],
    "process.executable": [
      "C:\\Users\\Public\\nanodump.x64.exe"
    ],
    "process.Ext.api.parameters.handle_type": [
      "process"
    ],
    "Target.process.name.caseless": [
      "lsass.exe"
    ],
    "data_stream.namespace": [
      "default"
    ],
    "Target.process.name.text": [
      "lsass.exe"
    ],
    "process.thread.Ext.call_stack.module_path": [
      "C:\\Users\\Public\\nanodump.x64.exe",
      "C:\\Users\\Public\\nanodump.x64.exe",
      "C:\\Users\\Public\\nanodump.x64.exe",
      "C:\\Users\\Public\\nanodump.x64.exe",
      "C:\\Users\\Public\\nanodump.x64.exe",
      "C:\\Windows\\System32\\kernel32.dll",
      "C:\\Windows\\System32\\ntdll.dll"
    ],
    "message": [
      "Endpoint Credential Access event"
    ],
    "process.thread.Ext.call_stack_final_user_module": [
      {
        "path": [
          "C:\\Users\\Public\\nanodump.x64.exe"
        ]
      }
    ],
    "host.os.Ext.variant": [
      "Windows Server 2016 Datacenter"
    ],
    "event.ingested": [
      "2023-03-02T13:03:28Z"
    ],
    "@timestamp": [
      "2023-03-02T13:03:20.247Z"
    ],
    "host.os.platform": [
      "windows"
    ],
    "data_stream.dataset": [
      "endpoint.events.api"
    ],
    "event.type": [
      "access"
    ],
    "process.Ext.api.parameters.desired_access_numeric": [
      5136
    ],
    "event.id": [
      "N+0LdfhWYmXMIih5+++++HFs"
    ],
    "Target.process.name": [
      "lsass.exe"
    ],
    "host.os.name.caseless": [
      "windows"
    ],
    "event.dataset": [
      "endpoint.events.api"
    ],
    "user.name.text": [
      "jbrown"
    ]
  }
}

[terrancedejesus]

So these are win32 API names we can specify rather than relying on event.code? When I looked at the PR, I started to ask why not include common APIs used for dumping such as PssCaptureSnapShot or MiniDumpWriteDump where we have existing rules covering this or do we keep this rule more generic.

Example: https://www.elastic.co/guide/en/security/master/potential-lsass-memory-dump-via-psscapturesnapshot.html

[terrancedejesus]

Left some comments, questions and suggestions. To avoid blockage, I am approving as the existing logic seems fine for a generic detection approach. Feel free to adjust or not based on your expertise 😄

[Samirbous]

So these are win32 API names we can specify rather than relying on event.code? When I looked at the PR, I started to ask why not include common APIs used for dumping such as PssCaptureSnapShot or MiniDumpWriteDump where we have existing rules covering this or do we keep this rule more generic.

Example: https://www.elastic.co/guide/en/security/master/potential-lsass-memory-dump-via-psscapturesnapshot.html

the api where target is lsass should capture them all (it trigger on any process handle with lsass being the process.name).

[w0rk3r]

🔥 🧙🏼