Credential Dumping Tools - Service Installation

Back


Id	4ebbb5c2-8802-11ec-a8a3-0242ac120002
Rulename	Credential Dumping Tools - Service Installation
Description	This query detects the installation of a Windows service that contains artifacts from credential dumping tools such as Mimikatz.
Severity	High
Tactics	CredentialAccess
Techniques	T1003.001
Required data connectors	SecurityEvents WindowsSecurityEvents
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker Tools Threat Protection Essentials/Analytic Rules/CredentialDumpingServiceInstallation.yaml
Version	1.0.3
Arm template	4ebbb5c2-8802-11ec-a8a3-0242ac120002.json

KQL

// Enter a reference list of decoy users (usernames) "Case Sensitive"
let MaliciousServiceArtifacts = dynamic (["fgexec","cachedump","mimikatz","mimidrv","wceservice","pwdump"]);
Event
| where Source == "Service Control Manager" and EventID == 7045
| parse EventData with * 'ServiceName">' ServiceName "<" * 'ImagePath">' ImagePath "<" *
| where ServiceName has_any (MaliciousServiceArtifacts) or ImagePath has_any (MaliciousServiceArtifacts)
| parse EventData with * 'AccountName">' AccountName "<" *
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, ServiceName, ImagePath, AccountName
| extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')

YAML

tactics:
- CredentialAccess
query: |
  // Enter a reference list of decoy users (usernames) "Case Sensitive"
  let MaliciousServiceArtifacts = dynamic (["fgexec","cachedump","mimikatz","mimidrv","wceservice","pwdump"]);
  Event
  | where Source == "Service Control Manager" and EventID == 7045
  | parse EventData with * 'ServiceName">' ServiceName "<" * 'ImagePath">' ImagePath "<" *
  | where ServiceName has_any (MaliciousServiceArtifacts) or ImagePath has_any (MaliciousServiceArtifacts)
  | parse EventData with * 'AccountName">' AccountName "<" *
  | summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, ServiceName, ImagePath, AccountName
  | extend HostName = split(Computer, '.', 0)[0], DnsDomain = strcat_array(array_slice(split(Computer, '.'), 1, -1), '.')  
requiredDataConnectors:
- dataTypes:
  - Event
  connectorId: SecurityEvents
- dataTypes:
  - Event
  connectorId: WindowsSecurityEvents
name: Credential Dumping Tools - Service Installation
kind: Scheduled
queryPeriod: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker Tools Threat Protection Essentials/Analytic Rules/CredentialDumpingServiceInstallation.yaml
triggerThreshold: 0
description: |
    'This query detects the installation of a Windows service that contains artifacts from credential dumping tools such as Mimikatz.'
version: 1.0.3
status: Available
queryFrequency: 1h
severity: High
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountName
- entityType: File
  fieldMappings:
  - identifier: Name
    columnName: ImagePath
- entityType: Host
  fieldMappings:
  - identifier: HostName
    columnName: HostName
  - identifier: DnsDomain
    columnName: DnsDomain
triggerOperator: gt
id: 4ebbb5c2-8802-11ec-a8a3-0242ac120002
relevantTechniques:
- T1003.001

ARM