Windows: SafetyKatz LSASS dump default file indicator (Temp\debug.bin)
Flags Windows file events with a target path ending in \Temp\debug.bin, consistent with SafetyKatz LSASS dump output.
- Product
- windows
- Category
- file_event
- Author
- Markus Neis (SigmaHQ), DRL 1.1
- Published
- 2018-07-24
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags a file creation or access event where the target filename ends with \Temp\debug.bin, which matches the default dump filename generated by SafetyKatz. Attackers commonly use credential dumping tools to extract sensitive authentication material from LSASS, and artifacts written to temporary paths can provide a high-signal indicator. The detection relies on Windows file event telemetry that includes the target filename.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: SafetyKatz LSASS dump default file indicator (Temp\\debug.bin)"
id: 8216cfe7-2bbd-4f9e-8ff1-096b35eed8f3
status: test
description: This rule flags a file creation or access event where the target filename ends with \Temp\debug.bin, which matches the default dump filename generated by SafetyKatz. Attackers commonly use credential dumping tools to extract sensitive authentication material from LSASS, and artifacts written to temporary paths can provide a high-signal indicator. The detection relies on Windows file event telemetry that includes the target filename.
references:
- https://github.com/GhostPack/SafetyKatz
- https://github.com/GhostPack/SafetyKatz/blob/715b311f76eb3a4c8d00a1bd29c6cd1899e450b7/SafetyKatz/Program.cs#L63
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_safetykatz.yml
author: Markus Neis, Huntrule Team
date: 2018-07-24
modified: 2024-06-27
tags:
- attack.credential-access
- attack.t1003.001
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: \Temp\debug.bin
condition: selection
falsepositives:
- Rare legitimate files with similar filename structure
level: high
license: DRL-1.1
related:
- id: e074832a-eada-4fd7-94a1-10642b130e16
type: derived