LSASS Process Reconnaissance Via Findstr.EXE

Title: LSASS Process Reconnaissance Via Findstr.EXE
Status: test
Description:Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID
References:
  -https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
Author: Florian Roth (Nextron Systems)
Date: 2022-08-12
modified:2024-06-04
Tags:

• -'attack.credential-access'
• -'attack.t1552.006'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_findstr_img:
    - Image|endswith:
      - '\find.exe'
      - '\findstr.exe'
    - OriginalFileName:
      - 'FIND.EXE'
      - 'FINDSTR.EXE'
  selection_findstr_cli:
    CommandLine|contains: 'lsass'
  selection_special:
    CommandLine|contains|windash:
      -' /i "lsass'
      -' /i lsass.exe'
      -'findstr "lsass'
      -'findstr lsass'
      -'findstr.exe "lsass'
      -'findstr.exe lsass'

  condition:all of selection_findstr_* or selection_special
Falsepositives:
  -Unknown
Level: high