huntrule

Windows LSASS Memory Dump File Creation

Alerts on Windows file creation of LSASS memory dump artifacts identified by high-confidence filename patterns.

FreeUnreviewedSigmahighv1
title: Windows LSASS Memory Dump File Creation
id: 4f15d601-3712-432c-ac0c-c80bf09055fb
related:
  - id: db2110f3-479d-42a6-94fb-d35bc1e46492
    type: obsolete
  - id: 5e3d3601-0662-4af0-b1d2-36a05e90c40a
    type: obsolete
  - id: a5a2d357-1ab8-4675-a967-ef9990a59391
    type: derived
status: test
description: This rule flags the creation of files with specific names and patterns commonly used for dumping the LSASS process memory, which can expose credentials. Attackers rely on LSASS memory dumps to extract authentication material without needing to access the original secrets directly. The detection uses Windows file creation telemetry by matching target filename endings and substrings associated with multiple known dumping utilities.
references:
  - https://www.google.com/search?q=procdump+lsass
  - https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf
  - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml
  - https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/
  - https://github.com/helpsystems/nanodump
  - https://github.com/CCob/MirrorDump
  - https://github.com/safedv/RustiveDump/blob/1a9b026b477587becfb62df9677cede619d42030/src/main.rs#L35
  - https://github.com/ricardojoserf/NativeDump/blob/01d8cd17f31f51f5955a38e85cd3c83a17596175/NativeDump/Program.cs#L258
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-15
modified: 2024-10-08
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: file_event
detection:
  selection_1:
    TargetFilename|endswith:
      - \Andrew.dmp
      - \Coredump.dmp
      - \lsass.dmp
      - \lsass.rar
      - \lsass.zip
      - \NotLSASS.zip
      - \PPLBlade.dmp
      - \rustive.dmp
  selection_2:
    TargetFilename|contains:
      - \lsass_2
      - \lsassdmp
      - \lsassdump
  selection_3:
    TargetFilename|contains|all:
      - \lsass
      - .dmp
  selection_4:
    TargetFilename|contains: SQLDmpr
    TargetFilename|endswith: .mdmp
  selection_5:
    TargetFilename|contains:
      - \nanodump
      - \proc_
    TargetFilename|endswith: .dmp
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags the creation of files with specific names and patterns commonly used for dumping the LSASS process memory, which can expose credentials. Attackers rely on LSASS memory dumps to extract authentication material without needing to access the original secrets directly. The detection uses Windows file creation telemetry by matching target filename endings and substrings associated with multiple known dumping utilities.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.