Suspicious Access To Credential Stores

Query

DeviceEvents
| where InitiatingProcessFileName != "lsass.exe"
| where (
    FolderPath startswith @"Cert:\LocalMachine\My\" 
    or (FolderPath startswith @"C:\ProgramData\Microsoft\Crypto\PCPKSP\" and FileName endswith "PCBKEY")
    or (FolderPath startswith @"C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Crypto\PCPKSP\" and FileName endswith "PCBKEY")
    or FolderPath has_any (@"CloudAPCache\AzureAD", @"cloudapcache\azuread") 
)
| extend 
    SuspiciousAccess = case(
        ProcessCommandLine has_any ("mimikatz", "dump", "export"), "High",
        InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "wmic.exe"), "Medium",
        "Low"
    )

About this query

Suspicious Access to Credential Stores

EXPERIMENTAL

Query Information

MITRE ATT&CK Technique(s)

Technique ID	Title	Link
T1003	OS Credential Dumping	https://attack.mitre.org/techniques/T1003

Description

Detects suspicious process access to common credential storage locations such as certificate stores, PCPKSP keys, and CloudAPCache for AzureAD credentials. The severity of the alert is escalated based on the initiating process and command line arguments, specifically looking for keywords like 'mimikatz', 'dump', or 'export'.

Author <Optional>

Name: Benjamin Zulliger
Github: https://github.com/benscha/KQLAdvancedHunting
LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/

References

Inspired by Nestori Syynimaa Trusted by Design: How Windows Uses TPM to Secure PRTs https://yellowhat.live/session-catalog/

Defender XDR

Explanation

This query is designed to detect suspicious activities related to accessing credential storage locations on a device. It specifically looks for processes that are not "lsass.exe" and checks if they are accessing certain sensitive folders or files that are commonly used to store credentials, such as certificate stores, PCPKSP keys, and AzureAD credentials cache.

The query focuses on the following:

Folder Paths: It checks if the process is accessing:
- Certificate stores located at Cert:\LocalMachine\My\.
- PCPKSP keys located in specific directories ending with "PCBKEY".
- AzureAD credentials cache in paths containing "CloudAPCache\AzureAD".
Suspicious Indicators: It evaluates the severity of the access based on:
- The presence of keywords like "mimikatz", "dump", or "export" in the command line, which are associated with credential dumping tools and activities. If found, the access is marked as "High" severity.
- If the process is initiated by common command-line tools like "powershell.exe", "cmd.exe", or "wmic.exe", it is marked as "Medium" severity.
- All other accesses are marked as "Low" severity.

The query is part of an experimental effort to identify potential credential dumping attempts, which is a technique used by attackers to extract sensitive information from a system.