Hub configuration

Name: Suspicious Kernel Dump Using Dtrace
Author: sigmahq

More info

Suspicious Kernel Dump Using Dtrace Detection Scenario by sigmahq | CrowdSec Hub

« Suspicious Kernel Dump Using Dtrace »
v0.2 by sigmahq / proc_creation_win_dtrace_kernel_dump
Attack scenariowindowsNot spoofableLow confidence

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

Installation

cscli scenarios install sigmahq/proc_creation_win_dtrace_kernel_dump

YAML Configuration

1type: trigger
2name: sigmahq/proc_creation_win_dtrace_kernel_dump
3description: |
4  Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Image endsWith '\\dtrace.exe' && evt.Parsed.CommandLine contains 'lkd(0)' || evt.Parsed.CommandLine contains 'syscall:::return' && evt.Parsed.CommandLine contains 'lkd(')
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1082
15
16  label: "Suspicious Kernel Dump Using Dtrace"
17  behavior : "windows:audit"
18  remediation: false
19
20scope:
21  type: ParentProcessId
22  expression: evt.Parsed.ParentProcessId
23
24

Hub configuration

« Suspicious Kernel Dump Using Dtrace »v0.2 by sigmahq / proc_creation_win_dtrace_kernel_dumpAttack scenariowindowsNot spoofableLow confidenceMITRE:t1082

« Suspicious Kernel Dump Using Dtrace »
v0.2 by sigmahq / proc_creation_win_dtrace_kernel_dump
Attack scenariowindowsNot spoofableLow confidence