Back to cases

[Sample] Credential access attempt on WORKSTATION-01

Recon followed by an LSASS memory access on WORKSTATION-01. Sample data for the demo.

Timeline · 2 alerts

  1. Discovery: recon binary executed -> whoami.exeIn progress4d
  2. Credential dumping: C:\WINDOWS\system32\svchost.exe accessed LSASS memoryTrue positive4d

Verdict

True positive (simulated). The discovery and the LSASS access are consistent with a credential-theft attempt staged with Atomic Red Team.

Response steps

1. Isolate the host. 2. Reset credentials cached on it. 3. Hunt for the source process reading LSASS. 4. Confirm no dump file was exfiltrated.

Lessons learned

The LSASS access produced no telemetry until Sysmon ProcessAccess logging was enabled. Collection gaps hide the most serious techniques.