mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-01 16:47:42 +03:00
Initial commit - 611 cybersecurity skills across all subdomains
This commit is contained in:
mukul975
@@ -0,0 +1,87 @@
|
||||
# Standards and References - Credential Dumping Detection
|
||||
|
||||
## MITRE ATT&CK Mappings
|
||||
|
||||
### T1003 - OS Credential Dumping (Parent Technique)
|
||||
|
||||
| Sub-Technique | Name | Description |
|
||||
|---------------|------|-------------|
|
||||
| T1003.001 | LSASS Memory | Dumping credentials stored in LSASS process memory |
|
||||
| T1003.002 | Security Account Manager | Extracting local hashes from SAM database |
|
||||
| T1003.003 | NTDS | Stealing AD database from Domain Controllers |
|
||||
| T1003.004 | LSA Secrets | Accessing stored service account credentials |
|
||||
| T1003.005 | Cached Domain Credentials | Extracting DCC2 hashed credentials |
|
||||
| T1003.006 | DCSync | Simulating DC replication to extract credentials |
|
||||
| T1003.007 | Proc Filesystem (/proc) | Linux credential extraction |
|
||||
| T1003.008 | /etc/passwd and /etc/shadow | Unix credential files |
|
||||
|
||||
### Related Techniques
|
||||
- **T1555 - Credentials from Password Stores**: Browser, keychain, password manager credentials
|
||||
- **T1552 - Unsecured Credentials**: Files, registry, bash history, cloud metadata
|
||||
- **T1558 - Steal or Forge Kerberos Tickets**: Kerberoasting, Golden/Silver tickets
|
||||
- **T1550 - Use Alternate Authentication Material**: Pass the Hash, Pass the Ticket
|
||||
|
||||
### Tactic
|
||||
- **TA0006 - Credential Access**
|
||||
|
||||
## Detection Data Sources
|
||||
|
||||
### LSASS Access Detection
|
||||
| Source | Event ID | Details |
|
||||
|--------|----------|---------|
|
||||
| Sysmon | 10 | ProcessAccess - TargetImage = lsass.exe |
|
||||
| Windows Security | 4656 | Handle requested to process object |
|
||||
| Windows Security | 4663 | Attempt to access process object |
|
||||
| Windows Security | 4688 | Process creation with command line |
|
||||
| ETW | Microsoft-Windows-Kernel-Process | Kernel-level process access |
|
||||
|
||||
### SAM/Registry Detection
|
||||
| Source | Event ID | Details |
|
||||
|--------|----------|---------|
|
||||
| Sysmon | 1 | reg.exe with save SAM/SECURITY/SYSTEM |
|
||||
| Windows Security | 4656 | Handle to registry key |
|
||||
| Windows Security | 4688 | reg.exe/regedit.exe command line |
|
||||
|
||||
### DCSync Detection
|
||||
| Source | Event ID | Details |
|
||||
|--------|----------|---------|
|
||||
| Windows Security | 4662 | DS-Replication-Get-Changes operation |
|
||||
| Windows Security | 4624/4625 | Authentication to DC from non-DC source |
|
||||
| Network | DRSUAPI | RPC calls for directory replication |
|
||||
|
||||
### NTDS Access Detection
|
||||
| Source | Event ID | Details |
|
||||
|--------|----------|---------|
|
||||
| Sysmon | 1 | ntdsutil.exe, vssadmin.exe execution |
|
||||
| Windows Security | 4688 | Shadow copy creation commands |
|
||||
| VSS | 8224 | Volume Shadow Copy Service operations |
|
||||
|
||||
## LSASS Access Mask Reference
|
||||
|
||||
| Access Mask | Hex | Meaning |
|
||||
|-------------|-----|---------|
|
||||
| PROCESS_VM_READ | 0x0010 | Read process memory |
|
||||
| PROCESS_QUERY_INFORMATION | 0x0400 | Query process info |
|
||||
| 0x1010 | Combined | VM_READ + QUERY_INFO (Mimikatz default) |
|
||||
| 0x1038 | Combined | Common credential dumping mask |
|
||||
| 0x1FFFFF | PROCESS_ALL_ACCESS | Full access to process |
|
||||
| 0x0410 | Combined | Query + VM_READ minimal |
|
||||
|
||||
## Known Credential Dumping Tools
|
||||
|
||||
| Tool | Technique | Detection Signature |
|
||||
|------|-----------|-------------------|
|
||||
| Mimikatz | T1003.001, T1003.006 | LSASS access with 0x1010, sekurlsa module |
|
||||
| LaZagne | T1003.001, T1555 | Multi-credential extractor |
|
||||
| ProcDump | T1003.001 | Signed MS tool, -ma lsass.exe |
|
||||
| comsvcs.dll | T1003.001 | MiniDump via rundll32 |
|
||||
| secretsdump.py | T1003.002, T1003.003, T1003.006 | Impacket DCSync/SAM |
|
||||
| ntdsutil.exe | T1003.003 | IFM creation for NTDS |
|
||||
| SharpDump | T1003.001 | .NET LSASS dumper |
|
||||
| PPLdump | T1003.001 | PPL bypass LSASS dump |
|
||||
| nanodump | T1003.001 | Stealthy minidump |
|
||||
|
||||
## Regulatory References
|
||||
- NIST SP 800-171 Rev 2: 3.1.1 (Access Control)
|
||||
- CIS Controls v8: Control 6 (Access Control Management)
|
||||
- PCI DSS 4.0: Requirement 7 (Restrict Access)
|
||||
@@ -0,0 +1,134 @@
|
||||
# Detailed Hunting Workflow - Credential Dumping Detection
|
||||
|
||||
## Phase 1: LSASS Memory Access Hunting
|
||||
|
||||
### Step 1.1 - Sysmon Event ID 10 Analysis
|
||||
```spl
|
||||
index=sysmon EventCode=10 TargetImage="*\\lsass.exe"
|
||||
| where NOT match(SourceImage, "(?i)(csrss|svchost|services|lsass|wininit|MsMpEng|MsSense|CrowdStrike)")
|
||||
| eval suspicious_access=case(
|
||||
GrantedAccess="0x1FFFFF", "CRITICAL-Full_Access",
|
||||
GrantedAccess="0x1010", "HIGH-VM_Read_Query",
|
||||
GrantedAccess="0x1038", "HIGH-Credential_Dump_Mask",
|
||||
GrantedAccess="0x0410", "MEDIUM-Query_VM_Read",
|
||||
1=1, "LOW-Other"
|
||||
)
|
||||
| stats count by SourceImage, GrantedAccess, suspicious_access, Computer, User
|
||||
| sort -count
|
||||
```
|
||||
|
||||
### Step 1.2 - KQL for Microsoft Defender for Endpoint
|
||||
```kql
|
||||
DeviceEvents
|
||||
| where Timestamp > ago(7d)
|
||||
| where ActionType == "OpenProcessApiCall"
|
||||
| where FileName == "lsass.exe"
|
||||
| where InitiatingProcessFileName !in~ ("csrss.exe","svchost.exe","services.exe","MsMpEng.exe")
|
||||
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
|
||||
InitiatingProcessCommandLine, AdditionalFields
|
||||
| order by Timestamp desc
|
||||
```
|
||||
|
||||
### Step 1.3 - CrowdStrike Falcon Query
|
||||
```
|
||||
event_simpleName=ProcessRollup2 TargetProcessImageFileName=lsass.exe
|
||||
| where ContextProcessImageFileName!="csrss.exe" AND ContextProcessImageFileName!="svchost.exe"
|
||||
| stats count by ContextProcessImageFileName ComputerName UserName
|
||||
```
|
||||
|
||||
## Phase 2: SAM/SECURITY Hive Access
|
||||
|
||||
### Step 2.1 - Registry Save Operations
|
||||
```spl
|
||||
index=sysmon EventCode=1
|
||||
| where match(CommandLine, "(?i)reg\s+(save|export)\s+.*(SAM|SECURITY|SYSTEM)")
|
||||
| table _time Computer User Image CommandLine ParentImage
|
||||
```
|
||||
|
||||
### Step 2.2 - Shadow Copy for SAM Access
|
||||
```spl
|
||||
index=sysmon EventCode=1
|
||||
| where match(CommandLine, "(?i)(vssadmin|wmic)\s+.*(shadow|create)")
|
||||
| append [
|
||||
search index=sysmon EventCode=1
|
||||
| where match(CommandLine, "(?i)copy.*\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy")
|
||||
]
|
||||
| table _time Computer User CommandLine ParentImage
|
||||
```
|
||||
|
||||
## Phase 3: DCSync Detection
|
||||
|
||||
### Step 3.1 - Directory Replication Monitoring
|
||||
```spl
|
||||
index=wineventlog EventCode=4662
|
||||
| where match(Properties, "(?i)(1131f6aa|1131f6ad|89e95b76)")
|
||||
| where NOT match(SubjectUserName, "(?i)(\\$|DomainController)")
|
||||
| table _time SubjectUserName SubjectDomainName ObjectName Properties
|
||||
```
|
||||
|
||||
The GUIDs to monitor:
|
||||
- `1131f6aa-9c07-11d1-f79f-00c04fc2dcd2` = DS-Replication-Get-Changes
|
||||
- `1131f6ad-9c07-11d1-f79f-00c04fc2dcd2` = DS-Replication-Get-Changes-All
|
||||
- `89e95b76-444d-4c62-991a-0facbeda640c` = DS-Replication-Get-Changes-In-Filtered-Set
|
||||
|
||||
### Step 3.2 - Non-DC Source Validation
|
||||
```kql
|
||||
SecurityEvent
|
||||
| where EventID == 4662
|
||||
| where Properties has "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
|
||||
| where Computer !in (known_domain_controllers)
|
||||
| project TimeGenerated, Computer, SubjectAccount, SubjectDomainName
|
||||
```
|
||||
|
||||
## Phase 4: Tool-Specific Detection
|
||||
|
||||
### Step 4.1 - Mimikatz Indicators
|
||||
```spl
|
||||
index=sysmon (EventCode=1 OR EventCode=10)
|
||||
| where match(CommandLine, "(?i)(sekurlsa|lsadump|kerberos::list|crypto::cng|privilege::debug)")
|
||||
OR (EventCode=10 AND TargetImage="*\\lsass.exe" AND GrantedAccess IN ("0x1010","0x1038"))
|
||||
| table _time EventCode Computer User Image CommandLine GrantedAccess
|
||||
```
|
||||
|
||||
### Step 4.2 - Comsvcs.dll MiniDump Detection
|
||||
```spl
|
||||
index=sysmon EventCode=1 Image="*\\rundll32.exe"
|
||||
| where match(CommandLine, "(?i)comsvcs.*MiniDump")
|
||||
| table _time Computer User CommandLine ParentImage
|
||||
```
|
||||
|
||||
### Step 4.3 - ProcDump LSASS Detection
|
||||
```spl
|
||||
index=sysmon EventCode=1
|
||||
| where match(CommandLine, "(?i)procdump.*(-ma|-accepteula).*lsass")
|
||||
| table _time Computer User CommandLine ParentImage
|
||||
```
|
||||
|
||||
## Phase 5: Correlation and Impact Assessment
|
||||
|
||||
### Step 5.1 - Post-Credential-Dump Lateral Movement
|
||||
```spl
|
||||
index=sysmon EventCode=10 TargetImage="*\\lsass.exe" GrantedAccess IN ("0x1010","0x1038","0x1FFFFF")
|
||||
| rename Computer as src_host
|
||||
| join src_host [
|
||||
search index=wineventlog EventCode=4624 Logon_Type=3
|
||||
| rename Computer as src_host
|
||||
]
|
||||
| table _time src_host User SourceImage dest_host
|
||||
```
|
||||
|
||||
### Step 5.2 - Timeline Construction
|
||||
Build a timeline correlating:
|
||||
1. Initial LSASS access event (credential dump)
|
||||
2. Subsequent authentication events (Pass-the-Hash/Ticket)
|
||||
3. Lateral movement to new hosts
|
||||
4. Additional credential dumping on new hosts
|
||||
|
||||
## Phase 6: Reporting
|
||||
|
||||
### Key Metrics to Report
|
||||
- Number of unique hosts with LSASS access anomalies
|
||||
- Tools identified (known vs. custom)
|
||||
- Accounts potentially compromised
|
||||
- Lateral movement scope
|
||||
- Time from initial dump to last detected activity
|
||||
Reference in New Issue
Block a user