t1003 | LoFP

t1003

Title	Tags
actual failures in lsass.exe that trigger a crash dump (unlikely)	t1003 t1003.001 windows sigma
administrative activity	t1003 t1016 t1021 t1021.001 t1027 t1036 t1053 t1053.005 t1059 t1059.001 t1059.005 t1071 t1071.001 t1087 t1087.001 t1087.002 t1098 t1105 t1133 t1134 t1136 t1136.001 t1137 t1222 t1222.001 t1505 t1505.004 t1552 t1552.006 t1555 t1555.004 t1562 t1562.001 t1572 t1615 windows linux sigma
administrative work	t1003 t1056 t1056.001 linux sigma
administrator or network operator can execute this command. please update the filter macros to remove false positives.	t1003 T1003.008 t1016 t1070 t1070.004 t1136 t1136.001 t1222 t1222.002 t1485 t1547 t1547.006 t1548 t1548.001 t1548.003 t1574 t1574.006 endpoint splunk
administrators can create memory dumps for debugging purposes, but memory dumps of the lsass process would be unusual.	t1003 t1003.001 windows splunk
another service that uses a single -s command line switch	t1003 t1003.001 windows sigma
another tool that uses command line flags similar to procdump	t1003 t1003.001 t1036 windows sigma
another tool that uses the command line switches of xordump	t1003 t1003.001 t1036 windows sigma
antivirus products	t1003 t1003.001 windows sigma
antivirus, anti-spyware, anti-malware software	t1003 windows sigma
av signature updates	t1003 t1003.001 t1003.002 t1003.004 t1003.006 windows sigma
azure ad connect syncing operations.	t1003 t1003.006 endpoint splunk
backup software	t1003 t1486 windows sigma
command lines that use the same flags	t1003 t1003.001 t1036 windows sigma
copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator.	t1003 t1003.002 t1003.003 windows sigma
diagnostics	t1003 windows sigma
dumping hives for legitimate purpouse i.e. backup or forensic investigation	t1003 t1003.002 t1003.004 t1003.005 t1012 windows sigma
false positives are expected in cases in which procdump just gets copied to a different directory without any renaming	t1003 t1003.001 t1036 windows sigma
false positives are possible if the environment is using certificates for authentication.	t1003 endpoint splunk
false positives should be limited as the commands being identifies are quite specific to eventcode 4104 and mimikatz. filter as needed.	t1003 t1059.001 endpoint splunk
false positives should be limited as this is directly looking for mimikatz, the credential dumping utility.	t1003 endpoint splunk
false positives should be limited, but if any are present, filter as needed.	t1003 t1003.002 t1566 t1566.001 endpoint splunk
false positives should be limited, but if any are present, filter as needed. in some instances, `cscript.exe` is used for legitimate business practices.	t1003 t1003.002 endpoint splunk
false positives should be limited. filter as needed.	t1003 t1003.002 t1027 t1041 t1059 t1059.001 endpoint splunk
false positives will be present based on many factors. tune the correlation as needed to reduce too many triggers.	t1003 t1012 t1016 t1033 t1049 t1059 t1069 t1082 t1112 t1115 t1222 t1529 t1548 t1552 endpoint splunk
false positives will occur based on grantedaccess 0x1010 and 0x1400, filter based on source image as needed or remove them. concern is cobalt strike usage of mimikatz will generate 0x1010 initially, but later be caught.	t1003 t1003.001 endpoint splunk
false positives will occur based on grantedaccess and sourceuser, filter based on source image as needed. utilize this hunting analytic to tune out false positives in ttp or anomaly analytics.	t1003 t1003.001 endpoint splunk
false positives will occur based on legitimate application requests, filter based on source image as needed.	t1003 t1003.001 endpoint splunk
files with mimikatz in their filename	t1003 t1003.001 t1003.002 t1003.004 t1003.006 windows sigma
genuine dc promotion may trigger this alert.	t1003 t1003.006 endpoint splunk
google chrome googleupdate.exe	t1003 t1003.001 windows sigma
highly possible server administrators will troubleshoot with ntdsutil.exe, generating false positives.	t1003 t1003.003 endpoint splunk
if a computer is a member of a domain, dpapi has a backup mechanism to allow unprotection of the data. which will trigger this event.	t1003 t1003.004 windows sigma
it is possible some agent based products will generate false positives. filter as needed.	t1003 t1003.002 endpoint splunk
legitimate admin activity	t1003 t1003.003 t1018 t1069 t1069.002 t1087 t1087.002 t1482 t1562 t1562.004 windows linux sigma
legitimate admin usage	t1003 t1003.003 windows sigma
legitimate administrative activity related to shadow copies.	t1003 windows elastic
legitimate administrative tasks	t1003 t1003.005 windows sigma
legitimate administrator usage of vssadmin or wmic will create false positives.	t1003 t1003.003 endpoint splunk
legitimate administrator usage of wmic to create a shadow copy.	t1003 t1003.003 endpoint splunk
legitimate administrator using credential dumping tool for password recovery	t1003 t1003.001 t1003.002 t1003.004 t1003.005 t1003.006 t1569 t1569.002 windows sigma
legitimate administrator using tool for password recovery	t1003 t1003.001 t1003.002 t1003.003 t1003.004 t1003.005 windows sigma
legitimate administrator working with shadow copies, access for backup purposes	t1003 t1003.002 t1003.003 windows sigma
legitimate application that needs to do a full dump of their process	t1003 t1003.001 windows sigma
legitimate backup operation by authorized administrators. matches must be investigated and allowed on a case by case basis.	t1003 t1003.003 windows sigma
legitimate backup operation/creating shadow copies	t1003 t1003.003 windows sigma
legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable)	t1003 t1003.001 windows sigma
legitimate mssql server actions	t1003 t1003.001 windows sigma
legitimate powershell scripts	t1003 t1003.003 t1003.006 t1033 t1036 t1036.003 t1057 t1070 t1070.003 t1083 t1201 t1546 t1546.015 t1553 t1553.005 t1562 t1562.001 t1564 t1564.006 t1615 windows sigma
legitimate software accessing lsass process for legitimate reason; update the whitelist with it	t1003 t1003.001 windows sigma
legitimate software installed by the users for example in the \"appdata\" directory may access these files (for any reason).	t1003 windows sigma
legitimate software installed on partitions other than \"c:\\"	t1003 windows sigma
legitimate software such as av and edr	t1003 t1003.001 windows sigma
legitimate usage by software developers/testers	t1003 t1003.001 t1218 windows sigma
legitimate usage for administration purposes	t1003 t1003.005 t1218 windows sigma
legitimate usage of adplus for debugging purposes	t1003 t1003.001 windows sigma
legitimate usage to restore snapshots	t1003 t1003.003 windows sigma
legitimate use of one of these tools	t1003 t1588 t1588.002 windows sigma
legitimate use of procdump by a developer or administrator	t1003 t1003.001 t1036 windows sigma
legitimate use of volume shadow copy mounts (backups maybe).	t1003 t1003.002 windows sigma
legitimate use of vssvc. maybe backup operations. it would usually be done by c:\windows\system32\vssvc.exe.	t1003 t1003.002 windows sigma
limited false positives as the scope is limited to sam, system and security hives.	t1003 t1003.002 endpoint splunk
local domain admin account used for azure ad connect	t1003 t1003.006 windows sigma
mimikatz can be useful for testing the security of networks	t1003 windows sigma
monitoring activity	t1003 t1027 t1033 t1134 windows sigma
natively, `dllhost.exe` will access the files. every environment will have additional native processes that do as well. filter by process_name. as an aside, one can remove process_name entirely and add `object_name=shadowcopy`.	t1003 t1003.002 endpoint splunk
naughty administrators	t1003 t1003.001 t1003.002 t1003.004 t1003.006 windows sigma
new domain controllers or certian scripts run by administrators.	t1003 t1003.006 t1207 endpoint splunk
ntds maintenance	t1003 t1003.003 windows sigma
other legitimate network providers used and not filtred in this rule	t1003 windows sigma
other tools can access lsass for legitimate reasons and generate an event. in these cases, tweaking the search may help eliminate noise.	t1003 t1003.001 windows splunk
other tools can import the same dlls. these tools should be part of a whitelist. false positives may be present with any process that authenticates or uses credentials, powershell included. filter based on parent process.	t1003 t1003.001 windows splunk
powershell scripts fixing hivenightmare / serioussam acls	t1003 t1003.002 windows sigma
powershell scripts that use this capability for troubleshooting.	t1003 t1059 windows elastic
rare case of troubleshooting by an administrator or support that has to be investigated regardless	t1003 t1003.001 windows sigma
rare cases of administrative activity	t1003 t1003.002 windows sigma
rare legitimate crashing of the lsass process	t1003 t1003.001 windows sigma
rare legitimate dump of the process by the operating system due to a crash of lsass	t1003 t1003.001 windows sigma
rare legitimate files with similar filename structure	t1003 t1003.001 windows sigma
rare programs that contain the word dump in their name and access lsass	t1003 t1003.001 windows sigma
scripts and administrative tools used in the monitored environment	t1003 t1027 t1033 t1070 t1070.001 t1134 t1485 t1562 t1562.002 windows sigma
searching software such as \"everything.exe\"	t1003 windows sigma
some administrator activity can be potentially triggered, please add those users to the filter macro.	t1003 t1036 t1036.005 t1595 endpoint splunk
some rare backup scenarios	t1003 t1003.002 windows sigma
some taskmgr.exe related activity	t1003 t1003.001 windows sigma
the activity may be legitimate. other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. in these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.	t1003 t1003.001 windows splunk
the build engine is commonly used by windows developers but use by non-engineers is unusual.	t1003 t1036 t1055 t1059 t1127 t1555 windows elastic
this module can be loaded by a third party application. filter is needed.	t1003 t1056 t1056.002 t1219 t1589 T1589.001 endpoint splunk
to be determined	t1003 t1003.003 windows sigma
transferring sensitive files for legitimate administration work by legitimate administrator	t1003 t1003.001 t1003.002 t1003.003 zeek windows sigma
unknown cases in which werfault accesses lsass.exe	t1003 t1003.001 windows sigma
unlikely	t1003 t1003.001 t1003.002 t1003.004 t1003.005 t1003.006 t1005 t1007 t1008 t1012 t1014 t1016 t1018 t1021 t1021.002 t1021.003 t1021.006 t1027 t1027.005 t1033 t1036 t1036.003 t1036.005 t1036.007 t1041 t1046 t1047 t1048 t1048.001 t1053 t1053.003 t1053.005 t1055 t1055.001 t1056 t1057 t1059 t1059.001 t1059.002 t1059.003 t1068 t1070 t1071 t1071.001 t1071.004 t1078 t1082 t1083 t1087 t1090 t1090.001 t1090.003 t1105 t1106 t1112 t1115 t1123 t1127 t1132 t1132.001 t1133 t1134 t1134.001 t1134.002 t1134.004 t1136 t1136.001 t1136.002 t1137 t1137.002 t1140 t1190 t1202 t1203 t1204 t1210 t1213 t1213.003 t1216 t1218 t1218.001 t1218.008 t1218.010 t1218.011 t1218.013 t1219 t1486 t1489 t1490 t1496 t1498 t1499 t1499.001 t1505 t1505.003 t1526 t1528 t1543 t1543.003 t1546 t1546.008 t1546.015 t1548 t1548.003 t1550 t1550.003 t1552 t1552.004 t1553 t1553.004 t1555 t1556 t1557 t1557.001 t1558 t1558.003 t1562 t1562.001 t1562.002 t1562.010 t1564 t1564.004 t1566 t1569 t1569.002 t1570 t1574 t1574.001 t1574.002 t1586 t1587 t1587.001 t1588 t1588.002 t1590 t1590.001 t1590.002 t1620 t1649 windows opencanary okta m365 azure bitbucket macos linux sigma
unlikely, because no one should dump an lsass process memory	t1003 t1003.001 t1036 windows sigma
valid change	t1003 t1098 t1098.003 azure sigma
valid dc sync that is not covered by the filters; please report	t1003 t1003.006 windows sigma
valid user connecting using rdp	t1003 t1003.001 windows sigma
very unlikely	t1003 t1003.001 windows sigma
windows error reporting might produce similar behavior. in that case, check the pid associated with the \"-p\" parameter in the commandline.	t1003 t1003.001 windows sigma