Windows Execution of Doppelganger.exe LSASS Memory Dumper

title: Windows Execution of Doppelganger.exe LSASS Memory Dumper
id: 0eab50e9-522c-44d4-a887-ab801313b4d6
status: experimental
description: This rule flags process creation events where the executed image ends with Doppelganger.exe and the file hash impairs match one of the specified IMPHASH values. Doppelganger is an LSASS dumping tool that attackers use to obtain credential material from memory. The detection relies on Windows process creation telemetry and on hash/IMPHASH visibility in the event data.
references:
  - https://labs.yarix.com/2025/06/doppelganger-an-advanced-lsass-dumper-with-process-cloning/
  - https://github.com/vari-sh/RedTeamGrimoire/tree/668e0357072546065729ad623f8c02f7be21bb08/Doppelganger
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_doppelganger.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-07-01
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \Doppelganger.exe
    - Hashes|contains:
        - IMPHASH=AB94D5217896ADCD765A06B2D52F0AEB
        - IMPHASH=65F0EA61156EE0C2A35421926F0C7F78
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d474c8fe-bb69-4ea0-b7d9-f682b56d52d3
    type: derived