Windows: LSASS remote thread creation indicating password dumper behavior

Flags Windows remote thread creation targeting lsass.exe, a common pattern in password dumping activity.

FreeUnreviewedSigmahighv1

windows-lsass-remote-thread-creation-indicating-password-dumper-behavior-f239b326

title: "Windows: LSASS remote thread creation indicating password dumper behavior"
id: d56d04b5-6161-4d8e-bf20-4e794c1b8840
status: stable
description: This rule identifies potential password dumping by matching remote thread creation events that target lsass.exe (TargetImage ending with \lsass.exe). The rule relies on Windows telemetry for remote thread creation and the target process name to pinpoint credential-dumping behavior. Attackers use this technique to access LSASS memory, often resulting in many remote thread events from a single execution.
references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_susp_password_dumper_lsass.yml
author: Thomas Patzke, Huntrule Team
date: 2017-02-19
modified: 2021-06-21
tags:
  - attack.credential-access
  - attack.s0005
  - attack.t1003.001
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    StartModule: ""
  condition: selection
falsepositives:
  - Antivirus products
level: high
license: DRL-1.1
related:
  - id: f239b326-2f41-4d6b-9dfa-c846a60ef505
    type: derived

What it detects

This rule identifies potential password dumping by matching remote thread creation events that target lsass.exe (TargetImage ending with \lsass.exe). The rule relies on Windows telemetry for remote thread creation and the target process name to pinpoint credential-dumping behavior. Attackers use this technique to access LSASS memory, often resulting in many remote thread events from a single execution.

Known false positives

Antivirus products

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.