Windows LSASS memory access from TrolleyExpress/ProcessDump/dump64 processes
Alerts on Windows processes attempting to access lsass.exe from TrolleyExpress.exe, ProcessDump.exe, or dump64.exe with dump-like access rights.
- Product
- windows
- Category
- process_access
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-02-10
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process access events where a non-whitelisted process attempts to access lsass.exe, specifically when the source image ends with TrolleyExpress.exe, ProcessDump.exe, or dump64.exe. The granted access values matched indicate permissions consistent with reading sensitive process memory, a common step in credential dumping. It relies on process access telemetry that includes TargetImage, SourceImage, and GrantedAccess attributes.
Reporting behind it
- twitter.comhttps://twitter.com/_xpn_/status/1491557187168178176
- ired.teamhttps://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz
- twitter.comhttps://twitter.com/mrd0x/status/1460597833917251595
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows LSASS memory access from TrolleyExpress/ProcessDump/dump64 processes
id: 51cf3273-5836-42cd-9c8d-0192cc618d68
status: test
description: This rule flags Windows process access events where a non-whitelisted process attempts to access lsass.exe, specifically when the source image ends with TrolleyExpress.exe, ProcessDump.exe, or dump64.exe. The granted access values matched indicate permissions consistent with reading sensitive process memory, a common step in credential dumping. It relies on process access telemetry that includes TargetImage, SourceImage, and GrantedAccess attributes.
references:
- https://twitter.com/_xpn_/status/1491557187168178176
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz
- https://twitter.com/mrd0x/status/1460597833917251595
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-10
modified: 2023-11-29
tags:
- attack.credential-access
- attack.t1003.001
- attack.s0002
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|endswith: \lsass.exe
SourceImage|endswith:
- \TrolleyExpress.exe
- \ProcessDump.exe
- \dump64.exe
GrantedAccess|endswith:
- "10"
- "30"
- "50"
- "70"
- "90"
- B0
- D0
- F0
- "18"
- "38"
- "58"
- "78"
- "98"
- B8
- D8
- F8
- 1A
- 3A
- 5A
- 7A
- 9A
- BA
- DA
- FA
- "0x14C2"
- FF
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 4be8b654-0c01-4c9d-a10c-6b28467fc651
type: derived