credential_access_suspicious_security_package_loaded_by_lsass.yml

name: Suspicious security package DLL loaded
id: 2c74f176-9a95-4344-a1aa-15aa06e16919
version: 1.1.0
description: |
  Attackers can abuse Windows Security Support Provider and Authentication Packages to
  dynamically inject a Security Package into the Local Security Authority Subsystem Service
  process to intercept all logon passwords.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1003
  technique.name: OS Credential Dumping
  technique.ref: https://attack.mitre.org/techniques/T1003/
  subtechnique.id: T1003.001
  subtechnique.name: LSASS Memory
  subtechnique.ref: https://attack.mitre.org/techniques/T1003/001/
references:
  - https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/intercepting-logon-credentials-via-custom-security-support-provider-and-authentication-package

condition: >
  ps.name ~= 'lsass.exe'
    and
  thread.callstack.modules imatches ('?:\\Windows\\System32\\sspisrv.dll')
    and
  (load_unsigned_or_untrusted_module)

min-engine-version: 2.0.0