New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

XSIAM_PB_Credential_Dumping_using_a_known_tool #36614

Open

OmriItzhak wants to merge 3 commits into master from XSIAM_PB_Credential_Dumping_using_a_known_tool

+790 −1

Contributor

OmriItzhak commented Oct 6, 2024

Status

In Progress
Ready
In Hold - (Reason for hold)

Related Issues

fixes: https://jira-dc.paloaltonetworks.com/browse/CIAC-10863

Description

A new core playbook and trigger for XSIAM designed to handle the alerts:

Command-line arguments match Mimikatz execution
Mimikatz command-line arguments
Credential dumping via wce.exe
Credential dumping via gsecdump.exe
PowerShell runs with known Mimikatz arguments
Hash cracking using Hashcat tool
Credential dumping via fgdump.exe
Credential dumping via LaZagne
Credential dumping via pwdumpx.exe
Dumping lsass.exe memory for credential extraction
Memory dumping with comsvcs.dll

Must have

Tests
Documentation

OmriItzhak added 3 commits

October 6, 2024 16:35


          PB and trigger


          ReleaseNotes

3f6f78b


          fix for validation error

6dc97ca

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet