Can I use adaptive threat prevention(ATP) to block read password in memory dump file?

[Soiluyen]

Hello everyone,

I want use ATP to block trojan, malware access and read password in memory dump file, but I'm worried about blue screen error when the system can't boot because the memory can't be read. I want to ask if ATP can block, and if so, what rule should I activate, and prevent blue screen error. if can, please share me expert rule or kb can block trojan, malware access and read password in memory dump file.

Thank you so much!

[rfranci]

Hi @Soiluyen 

You have too many options for this.

1. ENS Threat prevention Exploit prevention signature : 6154, 6143, 6117, 6116, 6122, 6078.

6154  -  T1003 - LSASS memory read attempt to dump Credentials

6143 - T1003 - Attempt to Dump Password Hash from SAM Database

6117 - T1003 - Mimikatz LSASS Suspicious Memory DMP Read

6116 - T1003 - Mimikatz LSASS Suspicious Memory Read

6122-T1003 - Fileless Threat : Reflective Loading of mimikatz using DotNetToJScript Technique

6078 - T1003 - Mimikatz usage

2. Enable Access protection rule : Executing Mimikatz malware

3.In ENS ATP options policy enable : Credential Theft Protection

4. In EPO Server settings go to 'adaptive threat protection' -> edit -> enable rule ID 511 (Detect attempts to dump sensitive information via registry or lsass ).

Apart from this we have ATP rule ID 217 enabled by default to Identify a suspicious password stealer.

I hope this helps!

-Rohit Francis 
Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[Soixam24]

Thank rfranci very much, I will make follow your recommend. 

Thank you and good day!

[Soixam24]

Hi rfranci,

I had enable list signature of exploit prevention and ID 511 of ATP follow your recommencd, then I perform run tool Mimikatz, ATP block ok, but when I open powershell and run command line: "reg save hklm\system system" and "reg save hklm\sam sam", then I analyzer san file and system file, I still readable password, ATP and exploit prevention not report or block. can you please share me the way to block when perform run reg save hklm\system system and reg save hklm\sam sam on powershell, prevent read password in registry

Thank you so much!

[Daveb3d]

Rule {
	Target {
		Match PROCESS {	
			Include OBJECT_NAME { 
				-v "reg.exe"
			}			
			Include PROCESS_CMD_LINE {
				-v "**export HKLM\\SAM**"
				-v "**export HKLM\\SYSTEM**"
				-v "**export HKLM\\SECURITY**"
				-v "**save HKLM\\SAM**"
				-v "**save HKLM\\SYSTEM**"
				-v "**save HKLM\\SECURITY**"
			}
			Include -access "CREATE"
		}
	}
}

[Daveb3d]

There is a lot that complicates this. The biggest issue is that you don't need to necessarily dump to disk or dump to a .dmp file. I would definitely enable all the rules that are recommended, but then I would also implement a couple of rules like the following to prevent exposure. 

I'll direct message you a couple of rules you can use that will reduce most further exposure points.

[Soixam24]

Thank Daveb3dReport,

Can you please send for me couple of rules to my email: **personal information omitted**? 

Thank you and good day!

[Daveb3d]

It didn't put your email address in.  I sent the rules to you in a private message on here.  If you need it emailed, you'll have to obfuscate your email address a bit to allow it to be posted it seems.

[Soixam24]

Dear Sir,

please send me expert rule of exploit prevention can block read password in memory dump file or export SAM file from registry.

please send to my mail address. I attach my email image bellow.

Thank you so much!

[Daveb3d]

For starters, ATP will stop task manager from dumping LSASS.  The following rule will expand coverage for you.  You can build it out further yourself.

Rule {
	Process {
		#Block Untrusted Processes.  DAC Must be set to contain at Unknown.
		Include AggregateMatch {
			Include PROCESS_STATE_BITS -name DAC_CONTAIN_PID_BITS { -v 0x1 }
			#Exclude CERT_NAME_CHAINED {
			#	-v "ADD CERT EXCLUSIONS HERE"
			#}
		}
		#scripts
		Include AggregateMatch {
			Include OBJECT_NAME {
				-v "powershell.exe"
				-v "wscript.exe"
				-v "cscript.exe"
			}
			#Exclude PROCESS_CMD_LINE {
			#	-v "ADD CMD LINE EXCLUSIONS HERE"
			#}
		}
		#Procdump, reg and Python 
		Include AggregateMatch {
			Include DESCRIPTION {
				-v "Python"
				-v "Sysinternals process dump utility"
				#This next one is only added to cover reading the registry.  
				-v "Registry Console Tool"
			}
		}
	}
	Target {
		#block reading LSASS
		Match PROCESS {
			Include OBJECT_NAME { -v "lsass.exe" }
			Include -nt_access "!0x0010" 
		}
		#block reg dump
		Match VALUE {
			Include OBJECT_NAME {
				-v "HKLM\\SAM\\**"
				-v "HKLM\\Security**"
			}
			Include -access "READ"
		}
	}
}