Kill Chain — Credential Dumping Agent Response

When this fires: credential_dumping_agent detected LSASS memory access (EventID 4688 with lsass.exe as target, comsvcs.dll/MiniDump pattern) or a password spray (5+ failed auth against 3+ accounts from the same source, followed by a success within 60 minutes).

Severity: CRITICAL — immediate notification, no analyst queue.

MITRE: T1003.001 (OS Credential Dumping: LSASS Memory), T1110.003 (Brute Force: Password Spraying)

---

Immediate Triage — Within 5 Minutes

Determine the alert subtype:

• lsass_access — process accessing LSASS memory → credentials are likely in attacker hands
• password_spray — automated auth attempts followed by a success → one or more accounts are compromised

1. Open SecOps finding. Note: host or source IP, account(s), timestamp, subtype
2. For LSASS access: identify the process that accessed LSASS (NewProcessName and CommandLine in evidence)
3. For password spray: identify the source IP (internal or external?) and the account that was successfully authenticated after the spray

---

Response — LSASS Access

Credentials from LSASS include NTLM hashes, Kerberos tickets, and potentially cleartext passwords. Once LSASS is dumped, treat all credentials on that host as compromised.

Step 1 — Isolate the host immediately:

• Cortex XDR: Endpoints → [host] → Actions → Isolate
• Arctic Wolf: call the hotline — they can act without approval

Step 2 — Enumerate accounts active on that host:

// All accounts with logon sessions on this host in last 4 hours
SecurityEvent
| where TimeGenerated > ago(4h)
| where EventID == 4624
| where Computer has "<hostname>"
| distinct TargetUserName
| where TargetUserName !endswith "$"

Step 3 — Force password reset for all those accounts:

For each account listed:

1. Entra → Users → [user] → Reset password → Require change on next login
2. Revoke all active sessions: Entra → Users → [user] → Revoke sessions

Do not just reset — revoke sessions. Active session tokens remain valid after a password reset if sessions are not also revoked.

Step 4 — Immediately check for lateral movement: Run the lateral movement KQL from runbooks/kill-chain-lateral-movement-response.md against all accounts that had sessions on the compromised host. Credential dumping is almost always followed by lateral movement.

Step 5 — Check for new Entra app registrations or service principals: A compromised account with sufficient privileges may create new app registrations or service principals for persistence.

AuditLogs
| where TimeGenerated > ago(4h)
| where OperationName in ("Add service principal", "Add application", "Add owner to application")
| project TimeGenerated, InitiatedBy, TargetResources, OperationName

---

Response — Password Spray

Step 1 — Identify the spray source:

// Full spray pattern: fails then success
SecurityEvent
| where TimeGenerated > ago(4h)
| where EventID in (4625, 4624)
| where IpAddress == "<spray_ip>"
| project TimeGenerated, EventID, TargetUserName, IpAddress, LogonType, WorkstationName
| order by TimeGenerated

Step 2 — Is the source internal or external?

• External IP: Block at Palo Alto immediately. Panorama → Policies → Security → add deny rule for the source IP (outbound/inbound)

  # Panorama CLI (connect via Twingate → Panorama IP)
  set address spray-source-<timestamp> ip-netmask <ip>/32
  set security rules block-spray-source-<timestamp> source ["spray-source-<timestamp>"] action deny
  commit

• Internal IP: That machine is compromised. Isolate it immediately and treat as a LSASS-access level event — the machine is an attack platform

Step 3 — Handle the successfully authenticated account:

1. Reset password immediately and revoke sessions
2. Check what the account accessed after the successful logon:

   SecurityEvent
   | where TimeGenerated > ago(4h)
   | where EventID in (4624, 4648, 5140)
   | where TargetUserName == "<sprayed_account>"
   | where TimeGenerated > datetime(<spray_success_time>)
   | project TimeGenerated, EventID, Computer, TargetUserName, LogonType

3. Check Entra SignInLogs for this account:

   SignInLogs
   | where TimeGenerated > ago(4h)
   | where UserPrincipalName == "<account>"
   | project TimeGenerated, AppDisplayName, IPAddress, Location, RiskLevelDuringSignIn,
       ConditionalAccessStatus, DeviceDetail

4. If the account accessed ePHI systems after the spray success: initiate breach risk assessment

---

HIPAA Breach Assessment

• LSASS dump on a host with ePHI access: credentials that grant ePHI access were likely compromised. Initiate 4-factor risk assessment per compliance/hipaa-breach-notification-procedure.md
• Password spray with successful access to an ePHI system: potentially a breach. Initiate risk assessment
• Password spray with success but account had no ePHI access: lower risk — document, remediate, no breach notification likely required

---

Escalation

• Rory immediately (automatic CRITICAL Telegram notification)
• Arctic Wolf for containment support and independent forensics
• Adriana if breach notification is triggered

---

Post-Incident Checklist

• [ ] Compromised host isolated
• [ ] All accounts that had sessions on the host — passwords reset, sessions revoked
• [ ] Spray source blocked (external IP) or source host isolated (internal)
• [ ] Credential Guard evaluated for affected hosts if not already enabled
• [ ] Service accounts on affected systems — passwords rotated
• [ ] Check for new app registrations or service principal creations by compromised accounts
• [ ] HIPAA breach assessment completed
• [ ] Lateral movement investigation completed (see kill-chain-lateral-movement-response.md)

---

Related Documents

• runbooks/kill-chain-execution-response.md — credential dumping often follows execution
• runbooks/kill-chain-lateral-movement-response.md — credential dumping is the precursor to lateral movement
• runbooks/entra-identity-operations.md — password reset and session revocation
• compliance/hipaa-breach-notification-procedure.md — if ePHI access was possible