Windows LSASS Memory Dump File Creation
Alerts on Windows file creation of LSASS memory dump artifacts identified by high-confidence filename patterns.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- file_event
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-11-15
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags the creation of files with specific names and patterns commonly used for dumping the LSASS process memory, which can expose credentials. Attackers rely on LSASS memory dumps to extract authentication material without needing to access the original secrets directly. The detection uses Windows file creation telemetry by matching target filename endings and substrings associated with multiple known dumping utilities.
Reporting behind it
- google.comhttps://www.google.com/search?q=procdump+lsass
- medium.comhttps://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf
- github.comhttps://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml
- whiteoaksecurity.comhttps://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/
- github.comhttps://github.com/helpsystems/nanodump
- github.comhttps://github.com/CCob/MirrorDump
- github.comhttps://github.com/safedv/RustiveDump/blob/1a9b026b477587becfb62df9677cede619d42030/src/main.rs#L35
- github.comhttps://github.com/ricardojoserf/NativeDump/blob/01d8cd17f31f51f5955a38e85cd3c83a17596175/NativeDump/Program.cs#L258
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-lsass-memory-dump-file-creation-a5a2d357
title: Windows LSASS Memory Dump File Creation
id: 4f15d601-3712-432c-ac0c-c80bf09055fb
related:
- id: db2110f3-479d-42a6-94fb-d35bc1e46492
type: obsolete
- id: 5e3d3601-0662-4af0-b1d2-36a05e90c40a
type: obsolete
- id: a5a2d357-1ab8-4675-a967-ef9990a59391
type: derived
status: test
description: This rule flags the creation of files with specific names and patterns commonly used for dumping the LSASS process memory, which can expose credentials. Attackers rely on LSASS memory dumps to extract authentication material without needing to access the original secrets directly. The detection uses Windows file creation telemetry by matching target filename endings and substrings associated with multiple known dumping utilities.
references:
- https://www.google.com/search?q=procdump+lsass
- https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf
- https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml
- https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/
- https://github.com/helpsystems/nanodump
- https://github.com/CCob/MirrorDump
- https://github.com/safedv/RustiveDump/blob/1a9b026b477587becfb62df9677cede619d42030/src/main.rs#L35
- https://github.com/ricardojoserf/NativeDump/blob/01d8cd17f31f51f5955a38e85cd3c83a17596175/NativeDump/Program.cs#L258
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-15
modified: 2024-10-08
tags:
- attack.credential-access
- attack.t1003.001
logsource:
product: windows
category: file_event
detection:
selection_1:
TargetFilename|endswith:
- \Andrew.dmp
- \Coredump.dmp
- \lsass.dmp
- \lsass.rar
- \lsass.zip
- \NotLSASS.zip
- \PPLBlade.dmp
- \rustive.dmp
selection_2:
TargetFilename|contains:
- \lsass_2
- \lsassdmp
- \lsassdump
selection_3:
TargetFilename|contains|all:
- \lsass
- .dmp
selection_4:
TargetFilename|contains: SQLDmpr
TargetFilename|endswith: .mdmp
selection_5:
TargetFilename|contains:
- \nanodump
- \proc_
TargetFilename|endswith: .dmp
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1