Windows ProcDump Command Lines Targeting LSASS Memory Dumps

Identifies suspicious ProcDump usage with dump flags and LSASS-related markers to indicate potential credential harvesting.

FreeUnreviewedSigmahighv1

windows-procdump-command-lines-targeting-lsass-memory-dumps-5afee48e

title: Windows ProcDump Command Lines Targeting LSASS Memory Dumps
id: 17f1a61b-a091-43d8-8a32-3564555bec26
status: stable
description: This rule flags Windows process creation events where the command line includes ProcDump dump flags (-ma, -mm, -mp) combined with LSASS-related process markers (e.g., "ls", "keyiso", "samss"). Dumping LSASS memory can expose sensitive authentication material, enabling credential theft for follow-on access. The detection relies on process creation telemetry, specifically the command line content.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
  - https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002
  - https://x.com/wietze/status/1958302556033065292?s=12
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-10-30
modified: 2025-10-19
tags:
  - attack.stealth
  - attack.t1036
  - attack.credential-access
  - attack.t1003.001
  - car.2013-05-009
logsource:
  category: process_creation
  product: windows
detection:
  selection_flags:
    CommandLine|contains|windash:
      - " -ma "
      - " -mm "
      - " -mp "
  selection_process:
    CommandLine|contains:
      - " ls"
      - " keyiso"
      - " samss"
  condition: all of selection_*
falsepositives:
  - Unlikely, because no one should dump an lsass process memory
  - Another tool that uses command line flags similar to ProcDump
level: high
license: DRL-1.1
related:
  - id: 5afee48e-67dd-4e03-a783-f74259dcf998
    type: derived

What it detects

This rule flags Windows process creation events where the command line includes ProcDump dump flags (-ma, -mm, -mp) combined with LSASS-related process markers (e.g., "ls", "keyiso", "samss"). Dumping LSASS memory can expose sensitive authentication material, enabling credential theft for follow-on access. The detection relies on process creation telemetry, specifically the command line content.

Known false positives

Unlikely, because no one should dump an lsass process memory
Another tool that uses command line flags similar to ProcDump

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.