Credential Dumping Tools - Service Installation

Back


Id	4ebbb5c2-8802-11ec-a8a3-0242ac120002
Rulename	Credential Dumping Tools - Service Installation
Description	This query detects the installation of a Windows service that contains artifacts from credential dumping tools such as Mimikatz.
Severity	High
Tactics	CredentialAccess
Techniques	T1003.001
Required data connectors	SecurityEvents WindowsSecurityEvents
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker Tools Threat Protection Essentials/Analytic Rules/CredentialDumpingServiceInstallation.yaml
Version	1.0.3
Arm template	4ebbb5c2-8802-11ec-a8a3-0242ac120002.json

KQL

// Enter a reference list of decoy users (usernames) "Case Sensitive"
let MaliciousServiceArtifacts = dynamic (["fgexec","cachedump","mimikatz","mimidrv","wceservice","pwdump"]);
Event
| where Source == "Service Control Manager" and EventID == 7045
| parse EventData with * 'ServiceName">' ServiceName "<" * 'ImagePath">' ImagePath "<" *
| where ServiceName has_any (MaliciousServiceArtifacts) or ImagePath has_any (MaliciousServiceArtifacts)
| parse EventData with * 'AccountName">' AccountName "<" *
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, ServiceName, ImagePath, AccountName
| extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')

YAML

entityMappings:
- fieldMappings:
  - columnName: AccountName
    identifier: Name
  entityType: Account
- fieldMappings:
  - columnName: ImagePath
    identifier: Name
  entityType: File
- fieldMappings:
  - columnName: HostName
    identifier: HostName
  - columnName: DnsDomain
    identifier: DnsDomain
  entityType: Host
severity: High
name: Credential Dumping Tools - Service Installation
triggerThreshold: 0
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker Tools Threat Protection Essentials/Analytic Rules/CredentialDumpingServiceInstallation.yaml
id: 4ebbb5c2-8802-11ec-a8a3-0242ac120002
kind: Scheduled
status: Available
queryFrequency: 1h
relevantTechniques:
- T1003.001
description: |
    'This query detects the installation of a Windows service that contains artifacts from credential dumping tools such as Mimikatz.'
query: |
  // Enter a reference list of decoy users (usernames) "Case Sensitive"
  let MaliciousServiceArtifacts = dynamic (["fgexec","cachedump","mimikatz","mimidrv","wceservice","pwdump"]);
  Event
  | where Source == "Service Control Manager" and EventID == 7045
  | parse EventData with * 'ServiceName">' ServiceName "<" * 'ImagePath">' ImagePath "<" *
  | where ServiceName has_any (MaliciousServiceArtifacts) or ImagePath has_any (MaliciousServiceArtifacts)
  | parse EventData with * 'AccountName">' AccountName "<" *
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, ServiceName, ImagePath, AccountName
  | extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')  
version: 1.0.3
tactics:
- CredentialAccess
queryPeriod: 1h
requiredDataConnectors:
- dataTypes:
  - Event
  connectorId: SecurityEvents
- dataTypes:
  - Event
  connectorId: WindowsSecurityEvents

ARM