Dumping of LSASS was not detected

[Anonymous]

I was doing some testing from the Red Canary Threat Report and executed the following command from an elevated PowerShell prompt

T1003.001: LSASS Memory
-------
rundll32.exe c:\Windows\System32\comsvcs.dll, MiniDump ((Get-Process lsass).Id) C:\windows\temp\lsass.dmp full

Nothing was detected in NetWitness. I'm running 11.5.0.1 NWE Advanced agent, have the Endpoint rule bundle deployed and even tried on multiple machines.

Any thoughts as to why this isn't being detected as a BOC?

[YounisKhan]

is there no alert at all even in concentrator ? or only on the host level ?

[Anonymous]

There is no alert at all for the command I was running.

There are alerts for other activities, for example i ran 'unblock-file' onto a directory and NWE raised alerts.

But for this rundll32.exe command there is nothing in either concentrator or host level.

[JoshRandall]

I suspect its because we're looking for lsass.exe.

Can you share a dump of all of the meta from the session?

[Anonymous]

I can’t share all the meta, but might be able to provide a redacted snippet, any suggestion what meta to include?

that being said, I have looked through all the meta during the time period I ran the command. I couldn’t find anything in the investigate module that would suggest it monitored this activity

when you say that you suspect it’s because you’re expected lsass.exe do you mean the exe itself being executed? 
I would’ve thought the use of rundll32 would trigger because there is other meta that reference rundll32

[JoshRandall]

edit: I should note that my lab is running 11.6, so there's a chance that improvements to the agent allow better visibility into this activity compared to 11.5.0.1 agents

I went and ran the same command in my lab, and although we do collect/track the activity with the advanced agent we are not raising any indicators or alerts to flag on it.

device.type = 'nwendpoint' AND filename.all = 'powershell.exe','rundll32.exe' AND category = 'Process Event'

There are a couple app rules that are close....but not close enough. I'll take this up with our PM and content teams.

[Anonymous]

Ahh, awesome. Thanks for that query. I was able to find it as well in my logs.