Windows LSASS Remote Thread Creation Indicative of Password Dumping
Flags Windows remote thread creation targeting lsass.exe, a common pattern in password dumping activity.
- Product
- windows
- Category
- create_remote_thread
- Author
- Thomas Patzke (SigmaHQ), DRL 1.1
- Published
- 2017-02-19
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies password-dumper activity by flagging remote thread creation events targeting lsass.exe (TargetImage ending in \lsass.exe). Remote thread creation against LSASS can be used to access or extract credentials from the process. It relies on telemetry for remote thread creation events (EventID 8) that record the target process and the injecting process (Process field).
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows LSASS Remote Thread Creation Indicative of Password Dumping
id: d56d04b5-6161-4d8e-bf20-4e794c1b8840
status: stable
description: This rule identifies password-dumper activity by flagging remote thread creation events targeting lsass.exe (TargetImage ending in \lsass.exe). Remote thread creation against LSASS can be used to access or extract credentials from the process. It relies on telemetry for remote thread creation events (EventID 8) that record the target process and the injecting process (Process field).
references:
- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_susp_password_dumper_lsass.yml
author: Thomas Patzke, Huntrule Team
date: 2017-02-19
modified: 2021-06-21
tags:
- attack.credential-access
- attack.s0005
- attack.t1003.001
logsource:
product: windows
category: create_remote_thread
detection:
selection:
TargetImage|endswith: \lsass.exe
StartModule: ""
condition: selection
falsepositives:
- Antivirus products
level: high
license: DRL-1.1
related:
- id: f239b326-2f41-4d6b-9dfa-c846a60ef505
type: derived