Testing detections that support automated host isolation

Overview

You can proactively test specific Blumira detections that support automated host isolation instead of waiting for a finding to be triggered by a security event. Follow the procedures below for the named detection rule then look for a related finding and auto-isolation notification after completing the testing steps. 

Dump LSASS.exe Memory using Windows Task Manager - P1 Threat

To test the detection “Dump LSASS.exe Memory using Windows Task Manager”:

1. On the host device, open Task Manager.
2. Click More details if needed.
   
3. Navigate to the Details tab.
   
4. Right-click lsass.exe.
5. In the options menu, click Create dump file.
   
6. A dump file is created and saved in the location shown in the confirmation window.
   

Rclone Execution via Command Line or PowerShell - P2 Threat

Note: For the sake of testing, you do not need to craft an entire rclone execution but rather trigger it as an attacker would.

To test the detection “Rclone Execution via Command Line or PowerShell”:

1. On the host device, download rclone https://downloads.rclone.org/rclone-current-windows-amd64.zip and unzip the file.
2. Open a PowerShell prompt (it does not have to be administrative) and navigate to the unzipped rclone directory.
3. Execute the following command: .\rclone.exe --help

findstr Password Discovery Activity - P2 Suspect

To test the detection “findstr Password Discovery Activity”:

1. Open a command prompt and type this command, replacing <domain> with the local domain that the endpoint is on:
   findstr /S /I cpassword \\<domain>\sysvol\<domain>\policies\*.xml
2. Press Enter.

Nltest Domain Enumeration - P3 Threat

To test the detection “Nltest Domain Enumeration”:

1. On the host device, open a command prompt.
2. Type nltest /domain_trusts and press Enter.