Windows: LSASS Dump (.dmp) Files in CrashDumps Folder
Alerts when an lsass.exe dump (.dmp) appears in the Windows CrashDumps directory under systemprofile.
- Product
- windows
- Category
- file_event
- Author
- @pbssubhash (SigmaHQ), DRL 1.1
- Published
- 2022-12-08
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies the presence of a Windows process dump file associated with lsass.exe in the CrashDumps directory under the systemprofile AppData Local path. Attackers can use LSASS memory dumps to extract credentials, so locating these artifacts is a strong indicator of potential credential dumping activity. It relies on file event telemetry that captures TargetFilename paths and extensions for .dmp dump files.
Reporting behind it
- github.comhttps://github.com/deepinstinct/Lsass-Shtinkering
- media.defcon.orghttps://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lsass_shtinkering.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: LSASS Dump (.dmp) Files in CrashDumps Folder"
id: a8c5944d-3fd8-499e-933d-c00c39ef927f
status: test
description: This rule identifies the presence of a Windows process dump file associated with lsass.exe in the CrashDumps directory under the systemprofile AppData Local path. Attackers can use LSASS memory dumps to extract credentials, so locating these artifacts is a strong indicator of potential credential dumping activity. It relies on file event telemetry that captures TargetFilename paths and extensions for .dmp dump files.
references:
- https://github.com/deepinstinct/Lsass-Shtinkering
- https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lsass_shtinkering.yml
author: "@pbssubhash, Huntrule Team"
date: 2022-12-08
tags:
- attack.credential-access
- attack.t1003.001
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|startswith: C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\
TargetFilename|contains: lsass.exe.
TargetFilename|endswith: .dmp
condition: selection
falsepositives:
- Rare legitimate dump of the process by the operating system due to a crash of lsass
level: high
license: DRL-1.1
related:
- id: 6902955a-01b7-432c-b32a-6f5f81d8f625
type: derived