Windows LSASS Memory Access Triggered by Process Name Containing 'dump'

Alerts when a process named with 'dump' requests specific access rights to lsass.exe on Windows.

FreeUnreviewedSigmahighv1

windows-lsass-memory-access-triggered-by-process-name-containing-dump-9bd012ee

title: Windows LSASS Memory Access Triggered by Process Name Containing 'dump'
id: 4cf15381-49dd-49d1-9e3f-931c14257cc9
status: test
description: This rule flags process access events targeting lsass.exe from a source process whose image name contains the keyword "dump". Access rights matching common read/memory-query style permissions are used to narrow the match to likely credential-dumping behavior. It relies on Windows process access telemetry that includes TargetImage, SourceImage, and GrantedAccess values, enabling detection of suspicious LSASS interactions by tools that name themselves with "dump".
references:
  - https://twitter.com/_xpn_/status/1491557187168178176
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_dump_keyword_image.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-10
modified: 2023-11-29
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0002
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    SourceImage|contains: dump
    GrantedAccess|endswith:
      - "10"
      - "30"
      - "50"
      - "70"
      - "90"
      - B0
      - D0
      - F0
      - "18"
      - "38"
      - "58"
      - "78"
      - "98"
      - B8
      - D8
      - F8
      - 1A
      - 3A
      - 5A
      - 7A
      - 9A
      - BA
      - DA
      - FA
      - "0x14C2"
      - FF
  condition: selection
falsepositives:
  - Rare programs that contain the word dump in their name and access lsass
level: high
license: DRL-1.1
related:
  - id: 9bd012ee-0dff-44d7-84a0-aa698cfd87a3
    type: derived

What it detects

This rule flags process access events targeting lsass.exe from a source process whose image name contains the keyword "dump". Access rights matching common read/memory-query style permissions are used to narrow the match to likely credential-dumping behavior. It relies on Windows process access telemetry that includes TargetImage, SourceImage, and GrantedAccess values, enabling detection of suspicious LSASS interactions by tools that name themselves with "dump".

Known false positives

Rare programs that contain the word dump in their name and access lsass

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.