wsmprovhost.exe accessing lsass - SERP Analysis

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Analytics-Alert-Reference-by-data-source/Wsmprovhost.exe-Rare-Child-Process

https://detection.fyi/sigmahq/sigma/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm/

https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_Mimikatz_through_Windows_Remote_Management.htm

https://www.microsoft.com/en-us/security/blog/2022/10/05/detecting-and-preventing-lsass-credential-dumping-attacks/

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Analytics-Alert-Reference-by-Alert-name/Wsmprovhost.exe-Rare-Child-Process

https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html

https://redcanary.com/threat-detection-report/techniques/lsass-memory/

https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/windows/credential_access_suspicious_lsass_access_generic

https://threathunterplaybook.com/hunts/windows/170105-LSASSMemoryReadAccess/notebook.html

https://www.microsoft.com/en-us/security/blog/2019/05/09/detecting-credential-theft-through-memory-access-modelling-with-microsoft-defender-atp/

https://attack.mitre.org/techniques/T1003/001/

https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html

https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before

https://www.elastic.co/guide/en/security/8.18/prebuilt-rule-8-4-3-suspicious-lsass-process-access.html

https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md

https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea

https://blog.cyberadvisors.com/technical-blog/attacks-defenses-dumping-lsass-no-mimikatz/

https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2

https://cyberdom.blog/defender-for-endpoint-bypassing-lsass-dump-with-powershell/

https://strontic.github.io/xcyclopedia/library/wsmprovhost.exe-893AD0503E3954706E5638F6957A9C83.html

https://research.splunk.com/endpoint/b3b7ce35-fce5-4c73-85f4-700aeada81a9/

https://reliaquest.com/blog/credential-dumping-part-2-how-to-mitigate-windows-credential-stealing/

https://redcanary.com/threat-detection-report/techniques/os-credential-dumping/

https://car.mitre.org/analytics/CAR-2019-08-001/

https://medium.com/falconforce/falconfriday-detecting-lsass-dumping-with-debug-privileges-0xff1f-328fdb78f5be

https://detection.fyi/elastic/detection-rules/windows/credential_access_suspicious_lsass_access_generic/

https://research.securitum.com/windows-security-what-is-lsass-dump-how-to-protect-against-it/

https://secybr.com/posts/dumping-lsass-without-mimikatz/

https://hawk-eye.io/2022/09/lsass-dumping-techniques/

https://www.reddit.com/r/digitalforensics/comments/1fcmn9c/what_could_be_the_reason_for_lsassexe_being/

https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/credential-access/credential-dumping/lsass-memory

https://security.stackexchange.com/questions/255388/windows-defenders-msmpeng-exe-access-lsass-exe

https://github.com/CompassSecurity/PowerLsassSilentProcessExit

https://www.youtube.com/watch?v=cxqRF9guVfU

https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-credentials-from-lsass.exe-process-memory

https://www.reddit.com/r/Splunk/comments/t4eeqk/windows_event_code_when_lsassexe_is_dumped/

https://www.manageengine.com/log-management/correlation-rules/wsmprovhost-lolbas-execution.html

https://app.tidalcyber.com/capability/9508c708-81dd-5e47-9959-cf3352ee1c09

https://www.youtube.com/watch?v=RW3cEdKbC4E

https://pwn3dx.gitbook.io/lsass-dump

https://blog.scrt.ch/2024/09/02/ghost-in-the-ppl-part-3-lsass-memory-dump/

https://detect.fyi/threat-hunting-suspicious-named-pipes-a4206e8a4bc8

https://lexfo.fr/category/lexlab/csirt/

https://cymulate.com/cybersecurity-glossary/credential-dumping/

https://docs.stellarcyber.ai/5.3.x/Using/ML/Alert-Rule-Based-Suspicious_LSASS_Process_Access.htm

https://www.ibm.com/docs/en/SS42VS_SHR/com.ibm.extensions.doc/r_sysmon_ext.html

https://cytomate.net/public/post/shadows-of-lsass-dumping-evasion-techniques-and-the-ongoing-struggle-of-edr-solutions-to-defend-a

https://www.youtube.com/watch?v=nw7q8Wl25dg

https://www.logpoint.com/wp-content/uploads/2024/07/logpoint-etpr-defending-against-os-credential-dumping.pdf

https://www.av-comparatives.org/wp-content/uploads/2024/05/avc_LSASS_2024_CrowdStrike.pdf

https://gbhackers.com/hackers-abuse-lsass-process/

https://www.thehacker.recipes/ad/movement/credentials/dumping/lsass

https://securelist.com/kaspersky-managed-detection-and-response-interesting-cases/105214/

https://elastic-content-share.eu/downloads/sigma-sysmon-detection-rules/

https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-2

https://asec.ahnlab.com/en/60690/

https://techdocs.broadcom.com/content/dam/broadcom/techdocs/us/en/dita/carbon-black/carbon-black-app-control/Legacy-PDFs/PDFs/Carbon%20Black%20App%20Control%201.10%20Rules%20Installer%20and%20Rapid%20Configs.pdf

https://cqureacademy.com/hacks/63-attacking-lsass/

https://blog.cyberadvisors.com/technical-blog/blog/credential-dumping-protections-part-2-bypass-lsa-protection

https://threathunt.blog/lsass-credential-dumping/

https://blog.syss.com/posts/powershell-lsa-parsing/

https://thebytemachine.com/detecting_lsass_credential_dumping_by_blackcat_ransomware

https://falconforce.nl/exploring-winrm-plugins-for-lateral-movement/

https://emptydc.com/2022/06/08/windows-credential-dumping/

https://www.oreilly.com/library/view/advanced-infrastructure-penetration/9781788624480/c54099a7-b74b-4130-9c8b-9aba41d42fb5.xhtml

https://www.linkedin.com/pulse/dfirdtr-tip-new-technique-abusing-wer-lsass-memory-mohammed-msscf

https://blog.lexfo.fr/cobalt-strike-investigation-part-2.html

https://docs.stellarcyber.ai/5.4.x/Using/ML/Alert-Rule-Based-Process-Creation_ParentChild.htm

https://malwarenailed.blogspot.com/2017/10/hunting-mimikatz-using-sysmon-elk-part.html

https://community.sophos.com/intercept-x-endpoint/f/discussions/133259/attack-surface-reduction-mitigation-re-lsass-memory-credential-dump-attack

https://www.manageengine.com/log-management/correlation-rules/suspicious-parent-spawning-lsass.html

https://matryoshkahax.hashnode.dev/lsass-and-credential-theft

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf

https://www.sentinelone.com/resources/youtubevideos/singularity-identity-vs-lsass-credential-dumping-attacks-protection-demo/

https://www.blumira.com/hubfs/pdfs/Blumira-Detections-Top-MITRE.pdf

https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-will-soon-block-windows-password-theft/

https://www.socinvestigation.com/os-credential-dumping-lsass-memory-vs-windows-logs/

https://speakerdeck.com/heirhabarov/hunting-for-credentials-dumping-in-windows-environment

https://hacktricks.boitatech.com.br/windows/stealing-credentials

https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment

https://security.stackexchange.com/questions/271739/why-would-jenkins-want-to-read-the-memory-of-lsass-exe

https://www.cyber.gov.au/sites/default/files/2024-09/PROTECT-Detecting-and-Mitigating-Active-Directory-Compromises.pdf

https://raw.githubusercontent.com/ion-storm/sysmon-config/master/sysmonconfig-export.xml

https://docs.sekoia.io/integration/categories/endpoint/windows/

https://juggernaut-sec.com/dumping-credentials-lsass-process-hashes/

https://www.youtube.com/watch?v=GoxR7W6vjns

https://www.bleepingcomputer.com/forums/t/454596/lsassexe-memory-usage-higher-than-normal/

https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsa-secrets

https://stackoverflow.com/questions/58436983/lsass-access-denied

https://huggingface.co/datasets/cowWhySo/sysmon-configuration-dpo/viewer/default/train?p=1

https://www.youtube.com/watch?v=o3ZSuHX-mBw

https://www.socinvestigation.com/credential-dumping-using-windows-network-providers-how-to-respond/

https://www.cnblogs.com/suv789/p/18053128

https://0xdf.gitlab.io/2024/03/09/htb-appsanity.html

https://elhacker.info/Cursos/Attacking%20and%20Defending%20Active%20Directory%20Advanced%20Edition%20(CRTE)/AD-Advanced-Slides.pdf

https://www.hybrid-analysis.com/sample/1bd87a8f3f65c3dd34c6ff6c061da2849ce7de96251bd6ffe14eae88d18f1d79/5863e73eaac2eddd1bcc1cf0

https://www.youtube.com/watch?v=U44zk6C7oXo&pp=ygUII2FsaXNhc3M%3D

https://www.ibm.com/docs/ja/SS42VS_SHR/com.ibm.extensions.doc/r_sysmon_ext.html

https://www.slideshare.net/slideshow/the-top-10-windows-logs-event-ids-used-v10/61193613

https://www.studocu.com/sg/document/nanyang-technological-university/information-security/index-508-index-for-for-508/99924058