Windows: LSASS Dump (.dmp) Files in CrashDumps Folder

Alerts when an lsass.exe dump (.dmp) appears in the Windows CrashDumps directory under systemprofile.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: @pbssubhash (SigmaHQ), DRL 1.1
Published: 2022-12-08
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies the presence of a Windows process dump file associated with lsass.exe in the CrashDumps directory under the systemprofile AppData Local path. Attackers can use LSASS memory dumps to extract credentials, so locating these artifacts is a strong indicator of potential credential dumping activity. It relies on file event telemetry that captures TargetFilename paths and extensions for .dmp dump files.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious Mimikatz Credential Dumping via Command Line Arguments

Malicious Credential Extraction via Volatility Memory Analysis (via process_creation)

Suspicious Physical Memory Acquisition via WinPmem (via process_creation)

Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)

Suspicious LSASS Credential Access via PowerShell (via process_creation)

Suspicious LSASS Memory Dump via Task Manager After Ivanti Exploitation

Suspicious ProcDump LSASS Memory Dump via process_creation

Malicious Mimikatz Credential Dump Log File Creation (via file_event)

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Theft (via registry_set)

Windows: LSASS Dump (.dmp) Files in CrashDumps Folder

Pivot detection · T1003.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-lsass-crash-dump-dmp-present-in-crashdumps-directory-6902955a

title: "Windows: LSASS Dump (.dmp) Files in CrashDumps Folder"
id: a8c5944d-3fd8-499e-933d-c00c39ef927f
status: test
description: This rule identifies the presence of a Windows process dump file associated with lsass.exe in the CrashDumps directory under the systemprofile AppData Local path. Attackers can use LSASS memory dumps to extract credentials, so locating these artifacts is a strong indicator of potential credential dumping activity. It relies on file event telemetry that captures TargetFilename paths and extensions for .dmp dump files.
references:
  - https://github.com/deepinstinct/Lsass-Shtinkering
  - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lsass_shtinkering.yml
author: "@pbssubhash, Huntrule Team"
date: 2022-12-08
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|startswith: C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\
    TargetFilename|contains: lsass.exe.
    TargetFilename|endswith: .dmp
  condition: selection
falsepositives:
  - Rare legitimate dump of the process by the operating system due to a crash of lsass
level: high
license: DRL-1.1
related:
  - id: 6902955a-01b7-432c-b32a-6f5f81d8f625
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL