Meta pixel

We surveyed 200+ security practitioners to discover the state of device management in 2022.

Click here to learn about their struggles and best practices.

{{thisPage.meta.articleTitle}}

{{articleSubtitle}}

| The author's GitHub profile picture

{{thisPage.meta.authorFullName}}

Fleet quick tips — identify systems where the ProcDump EULA has been accepted.

By now, you’ve no doubt already heard of Microsoft’s big email hack.

While attackers initially flew largely under the radar via an unknown vulnerability in the email software, the folks at Volexity observed a handful of post exploitation activities and tools that operators used to gain a foothold — one such tool being ProcDump, which attackers were observed using to dump LSASS process memory.

Identify systems where the ProcDump EULA has been accepted with Fleet

As a possible detection method using osquery and Fleet, check out this query from Recon InfoSec that looks for systems that accepted the ProcDump EULA. This query searches for a registry artifact that indicates ProcDump may have been used in a post-exploitation technique described by Microsoft’s security blog.

SELECT datetime(mtime, ‘unixepoch’, ‘localtime’) AS EULA_accepted,path
FROM registry
WHERE path LIKE ‘HKEY_USERS\%\Software\Sysinternals\ProcDump\EulaAccepted’;

*mtime = Time that EULA was accepted

For more information about the recent security breach, take a look at Microsoft’s original blog post.

Could this post be more helpful?

Let us know if you can think of any other example scenarios you’d like us to cover.


Explore Fleet

Find out how Fleet can benefit your organization by exploring our docs and community.
Want to get up and running quicker? Then try out Fleet locally on your device - you’ll be up and running in minutes.