Detection rules › Elastic

Potential LSASS Clone Creation via PssCaptureSnapShot

Author
Elastic
Source
upstream

Identifies the creation of an LSASS process clone via PssCaptureSnapShot where the parent process is the initial LSASS process instance. This may indicate an attempt to evade detection and dump LSASS memory for credential access.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003 OS Credential Dumping, T1003.001 OS Credential Dumping: LSASS Memory

Event coverage

ProviderEvent IDTitle
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: eql:process

process.executable:"?:\\Windows\\System32\\lsass.exe" and process.parent.executable:"?:\\Windows\\System32\\lsass.exe"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
process.executablewildcard
  • ?:\Windows\System32\lsass.exe
process.parent.executablewildcard
  • ?:\Windows\System32\lsass.exe