Python-Based Tool LSASS Process Access for Credential Dumping (Windows)

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process-access events where a process ending in lsass.exe is targeted with a high privilege access mask, along with a call trace indicative of Python-related modules. The combination of lsass.exe targeting and Python runtime artifacts suggests an attempted credential dumping workflow using a Python-based tool. It relies on process-access telemetry and call stack/call trace information that includes module paths and granted access details.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Malicious Credential Dumping via Mimikatz Sekurlsa Command

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

Malicious LSASS Credential Dump via ProcDump (via process_creation)

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

Malicious LSASS Dump via Process Access (via process_access)

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

Python-Based Tool LSASS Process Access for Credential Dumping (Windows)

Pivot detection · T1003.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-lsass-process-access-by-python-based-tool-f8be3e82

title: Python-Based Tool LSASS Process Access for Credential Dumping (Windows)
id: 47d2ed17-1d38-4b69-843b-fbf6cae4785c
related:
  - id: 4b9a8556-99c4-470b-a40c-9c8d02c77ed0
    type: obsolete
  - id: 7186e989-4ed7-4f4e-a656-4674b9e3e48b
    type: obsolete
  - id: f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9
    type: derived
status: stable
description: This rule identifies Windows process-access events where a process ending in lsass.exe is targeted with a high privilege access mask, along with a call trace indicative of Python-related modules. The combination of lsass.exe targeting and Python runtime artifacts suggests an attempted credential dumping workflow using a Python-based tool. It relies on process-access telemetry and call stack/call trace information that includes module paths and granted access details.
references:
  - https://twitter.com/bh4b3sh/status/1303674603819081728
  - https://github.com/skelsec/pypykatz
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_python_based_tool.yml
author: Bhabesh Raj, Jonhnathan Ribeiro, Huntrule Team
date: 2023-11-27
modified: 2023-11-29
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0349
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    CallTrace|contains|all:
      - _ctypes.pyd+
      - :\Windows\System32\KERNELBASE.dll+
      - :\Windows\SYSTEM32\ntdll.dll+
    CallTrace|contains:
      - python27.dll+
      - python3*.dll+
    GrantedAccess: "0x1FFFFF"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL