LSASS Credential Dumpin

This playbook is focused on detecting Credential Dumping attack as researched by Accenture Security analysts and engineers.

LSASS Credential Dumping · 25 tasks · 0 inputs · 0 outputs

Commands used

cb-eedr-device-quarantine extractIndicators isWhitelisted servicenow-create-ticket servicenow-update-ticket splunk-search tanium-tr-delete-file-from-endpoint tanium-tr-get-file-info

Flowchart

yes yes No Yes No Yes Start Start Check Allow List - isWhitelisted Check Allow List isWhitelisted Information Collection Information Collection Malicious Adversarial Activity Identified? Malicious Adversarial Act... Containment Actions Containment Actions Quarantine Host - cb-eedr-device-quarantine Quarantine Host cb-eedr-device-quarantine Contextualization Search Contextualization Search Check Network Traffic - Splunk - splunk-search Check Network Traffic - S... splunk-search Alert SOC Alert SOC Open Ticket - SNOW - servicenow-create-ticket Open Ticket - SNOW servicenow-create-ticket Manual SOC Investigation Manual SOC Investigation Dedup - Generic v3 - Dedup - Generic v3 Dedup - Generic v3 Dedup - Generic v3 Extract Indicators from the File - extractIndicators Extract Indicators from t... extractIndicators Is There a File Is There a File Entity Enrichment - Generic v3 - Entity Enrichment - Generic v3 Entity Enrichment - Gener... Entity Enrichment - Generic v3 Set Incident Severity - IncreaseIncidentSeverity Set Incident Severity IncreaseIncidentSeverity Grab Suspected File from Endpoint Machine - tanium-tr-get-file-info Grab Suspected File from ... tanium-tr-get-file-info Remove Files in Question? Remove Files in Question? Delete File from Endpoint Machine - tanium-tr-delete-file-from-endpoint Delete File from Endpoint... tanium-tr-delete-file-from-en... Manual Remediation Manual Remediation Update SNOW Ticket - servicenow-update-ticket Update SNOW Ticket servicenow-update-ticket Check for Other Machines with the same File Check for Other Machines ... Quarantine Those Machines? Quarantine Those Machines? Quarantine - cb-eedr-device-quarantine Quarantine cb-eedr-device-quarantine End Investigation End Investigation