Name:Windows InstallUtil Credential Theft id:ccfeddec-43ec-11ec-b494-acde48001122 version:6 date:2024-09-30 author:Michael Haag, Mauricio Velazo, Splunk status:production type:TTP Description:The following analytic detects instances where the Windows InstallUtil.exe binary loads `vaultcli.dll` and `Samlib.dll`. This detection leverages Sysmon EventCode 7 to identify these specific DLL loads. This activity is significant because it can indicate an attempt to execute code that bypasses application control and captures credentials using tools like Mimikatz. If confirmed malicious, this behavior could allow an attacker to steal credentials, potentially leading to unauthorized access and further compromise of the system. Data_source:
-Sysmon EventID 7
search:`sysmon` EventCode=7 process_name=installutil.exe loaded_file_path IN ("*\\samlib.dll", "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime by user_id, dest, process_name, loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_credential_theft_filter`
how_to_implement:To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives:Typically, this will not trigger because, by its very nature, InstallUtil does not require credentials. Filter as needed. References: -https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0 drilldown_searches: name:'View the detection results for - "$dest$"' search:'%original_detection_search% | search dest = "$dest$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'Signed Binary Proxy Execution InstallUtil' asset_type:Endpoint confidence:100 impact:80 message:An instance of process name [$process_name$] loading a file [$loaded_file$] was identified on endpoint- [$dest$] to potentially capture credentials in memory. mitre_attack_id: - 'T1218.004' - 'T1218' observable: name:'dest' type:'Hostname' - role: - 'Victim' name:'process_name' type:'Process' - role: - 'Attacker' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'Processes.dest' - 'Processes.user' - 'Processes.parent_process_name' - 'Processes.parent_process' - 'Processes.original_file_name' - 'Processes.process_name' - 'Processes.process' - 'Processes.process_id' - 'Processes.parent_process_path' - 'Processes.process_path' - 'Processes.parent_process_id' risk_score:80 security_domain:endpoint
