Detection rules › Sigma

HackTool - Doppelanger LSASS Dumper Execution

Severity
high
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
upstream

Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.001 OS Credential Dumping: LSASS Memory

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: selection

or:
Hashes|contains: 'IMPHASH=65F0EA61156EE0C2A35421926F0C7F78'
Hashes|contains: 'IMPHASH=AB94D5217896ADCD765A06B2D52F0AEB'
Image|endswith: '\Doppelganger.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Hashesmatch
  • IMPHASH=65F0EA61156EE0C2A35421926F0C7F78
  • IMPHASH=AB94D5217896ADCD765A06B2D52F0AEB
Imageends_with
  • \Doppelganger.exe