Windows: HandleKatz LSASS Dump Execution via loader.exe and obfuscated .obf output

title: "Windows: HandleKatz LSASS Dump Execution via loader.exe and obfuscated .obf output"
id: cca2addb-693b-44d6-b028-3a6839852a6c
status: test
description: This rule identifies execution patterns of the HandleKatz LSASS dumping tool by matching a specific loader executable name plus HandleKatz-specific command-line arguments and output artifacts. Attackers use HandleKatz-style cloned handle techniques to obtain an obfuscated memory dump of LSASS, which can enable credential access. The detection relies on Windows process creation telemetry, including the process Image path/name and command-line content, with additional matching on known loader IMPHASH values.
references:
  - https://github.com/codewhitesec/HandleKatz
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_handlekatz.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-18
modified: 2024-11-23
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_loader_img:
    Image|endswith: \loader.exe
    CommandLine|contains: "--pid:"
  selection_loader_imphash:
    Hashes|contains:
      - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055
      - IMPHASH=0E2216679CA6E1094D63322E3412D650
  selection_flags:
    CommandLine|contains|all:
      - "--pid:"
      - "--outfile:"
    CommandLine|contains:
      - .dmp
      - lsass
      - .obf
      - dump
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ca621ba5-54ab-4035-9942-d378e6fcde3c
    type: derived