Credential Dumping Tools - Service Installation

Back


Id	4ebbb5c2-8802-11ec-a8a3-0242ac120002
Rulename	Credential Dumping Tools - Service Installation
Description	This query detects the installation of a Windows service that contains artifacts from credential dumping tools such as Mimikatz.
Severity	High
Tactics	CredentialAccess
Techniques	T1003.001
Required data connectors	SecurityEvents WindowsSecurityEvents
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker Tools Threat Protection Essentials/Analytic Rules/CredentialDumpingServiceInstallation.yaml
Version	1.0.3
Arm template	4ebbb5c2-8802-11ec-a8a3-0242ac120002.json

KQL

// Enter a reference list of decoy users (usernames) "Case Sensitive"
let MaliciousServiceArtifacts = dynamic (["fgexec","cachedump","mimikatz","mimidrv","wceservice","pwdump"]);
Event
| where Source == "Service Control Manager" and EventID == 7045
| parse EventData with * 'ServiceName">' ServiceName "<" * 'ImagePath">' ImagePath "<" *
| where ServiceName has_any (MaliciousServiceArtifacts) or ImagePath has_any (MaliciousServiceArtifacts)
| parse EventData with * 'AccountName">' AccountName "<" *
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, ServiceName, ImagePath, AccountName
| extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')

YAML

query: |
  // Enter a reference list of decoy users (usernames) "Case Sensitive"
  let MaliciousServiceArtifacts = dynamic (["fgexec","cachedump","mimikatz","mimidrv","wceservice","pwdump"]);
  Event
  | where Source == "Service Control Manager" and EventID == 7045
  | parse EventData with * 'ServiceName">' ServiceName "<" * 'ImagePath">' ImagePath "<" *
  | where ServiceName has_any (MaliciousServiceArtifacts) or ImagePath has_any (MaliciousServiceArtifacts)
  | parse EventData with * 'AccountName">' AccountName "<" *
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, ServiceName, ImagePath, AccountName
  | extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')  
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AccountName
  entityType: Account
- fieldMappings:
  - identifier: Name
    columnName: ImagePath
  entityType: File
- fieldMappings:
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: DnsDomain
  entityType: Host
name: Credential Dumping Tools - Service Installation
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker Tools Threat Protection Essentials/Analytic Rules/CredentialDumpingServiceInstallation.yaml
queryPeriod: 1h
queryFrequency: 1h
kind: Scheduled
requiredDataConnectors:
- dataTypes:
  - Event
  connectorId: SecurityEvents
- dataTypes:
  - Event
  connectorId: WindowsSecurityEvents
version: 1.0.3
severity: High
relevantTechniques:
- T1003.001
tactics:
- CredentialAccess
status: Available
id: 4ebbb5c2-8802-11ec-a8a3-0242ac120002
description: |
    'This query detects the installation of a Windows service that contains artifacts from credential dumping tools such as Mimikatz.'
triggerThreshold: 0

ARM