Windows file event: SafetyKatz-style LSASS dump file named Temp\debug.bin

Flags Windows file events with a target path ending in \Temp\debug.bin, consistent with SafetyKatz LSASS dump output.

FreeUnreviewedSigmahighv1

windows-file-event-safetykatz-style-lsass-dump-file-named-temp-debug-bin-e074832a

title: "Windows file event: SafetyKatz-style LSASS dump file named Temp\\debug.bin"
id: 8216cfe7-2bbd-4f9e-8ff1-096b35eed8f3
status: test
description: This rule matches Windows file creation or modification events where the target path ends with \Temp\debug.bin. SafetyKatz uses this default output filename when generating an LSASS dump, so the presence of this artifact can indicate credential-access activity. The detection relies on file event telemetry that includes the full target filename or path.
references:
  - https://github.com/GhostPack/SafetyKatz
  - https://github.com/GhostPack/SafetyKatz/blob/715b311f76eb3a4c8d00a1bd29c6cd1899e450b7/SafetyKatz/Program.cs#L63
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_safetykatz.yml
author: Markus Neis, Huntrule Team
date: 2018-07-24
modified: 2024-06-27
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \Temp\debug.bin
  condition: selection
falsepositives:
  - Rare legitimate files with similar filename structure
level: high
license: DRL-1.1
related:
  - id: e074832a-eada-4fd7-94a1-10642b130e16
    type: derived

What it detects

This rule matches Windows file creation or modification events where the target path ends with \Temp\debug.bin. SafetyKatz uses this default output filename when generating an LSASS dump, so the presence of this artifact can indicate credential-access activity. The detection relies on file event telemetry that includes the full target filename or path.

Known false positives

Rare legitimate files with similar filename structure

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.