Threat detection with LimaCharlie – Part 3

Introduction

In today’s blog post, we will walk through the steps of exploiting SeDebugPrivileges for credential dumping, and utilizing LimaCharlie’s capabilities to detect it, as well as craft a Detection and Response (D&R) rule to alert and generate reports whenever such suspicious activity occurs again.

Dumping lsass.exe from Memory

To initiate the credential dumping process, we can utilize the SeDebugPrivilege to extract the lsass.exe process from memory. The command we will use is:
procdump -n lsass.exe -s lsass.dmp

This command captures the lsass.exe process and saves it in a dump file called lsass.dmp.

Detecting Credential Dumping with LimaCharlie

LimaCharlie offers robust event generation capabilities. Since lsass.exe is a highly sensitive process often targeted for credential dumping, LimaCharlie can help us detect such activities. We can begin by filtering for “SENSITIVE_PROCESS_ACCESS” events within the LimaCharlie interface.

Crafting an Effective Detection Rule

Once we have identified the events associated with credential access, we can construct a detection and response rule to automate the alerting process.

Our rule will specifically focus on SENSITIVE_PROCESS_ACCESS events where the victim or target process ends with lsass.exe. In the “Respond” section of the new rule, we will also configure LimaCharlie to generate a detection report whenever this activity occurs. This action allows us to receive immediate notifications whenever credential dumping is detected.

Testing the Detection Rule

LimaCharlie provides a convenient feature to test D&R rules. It sends the initial report to us for us to test if the D&R rule works as intended. After running the test, we can see that there is a match, and it matches exactly with what we planned for.

Let’s try the actual thing now. Running the procdump command again, we can see that our D&R rule does indeed work.

Conclusion

In this blog post, we explored the process of credential dumping using Sliver, as well as detecting said attack using LimaCharlie, a robust EDR solution. We also crafted a targeted D&R rule to enable us to generate alerts and reports whenever credential dumping activity is detected. In our next post, we will delve deeper into crafting a rule that can take proactive actions upon detecting threats, ensuring a more comprehensive defense against malicious activities.