AN0648
Analytic 0648
Windows
Processes accessing LSASS memory or SAM registry hives outside of trusted security tools, often followed by file creation or lateral movement. Detects unauthorized access to sensitive OS subsystems for credential extraction.
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Security
EventCode=4662
[AccessMask]
Set to detect full access rights (0x1F0FFF) or modify based on tool behavior.
[TimeWindow]
Define how soon access to LSASS is followed by suspicious file or registry activity.
[ParentProcessFilter]
Allowlist known security tools or system processes accessing LSASS.
AN0649
Analytic 0649
Linux
Processes opening /proc/*/mem or /proc/*/maps targeting credential-storing services like sshd or login. Behavior often includes high privilege escalation and memory inspection tools such as gcore or gdb.
auditd:SYSCALL
open
auditd:SYSCALL
ptrace
auditd:SYSCALL
execve
[TargetProcessName]
Define sensitive targets (e.g., sshd, login) being memory-read.
[ToolProcessName]
Flag use of memory dump tools like gcore, gdb, pmap.
AN0650
Analytic 0650
macOS
Unsigned processes accessing system memory or launching known credential scraping tools (e.g., osascript, dylib injections) to access the Keychain or sensitive memory regions.
macos:unifiedlog
Code Execution & Entitlement Access
macos:keychain
Access to Keychain DB or system.keychain
macos:osquery
Invocation of osascript or dylib injection
[KeychainAccessPath]
Path to watch for abnormal access, e.g., /Library/Keychains/
[SignedBinaryStatus]
Filter out signed/trusted binaries.