Windows ProcDump Command Lines Targeting LSASS Memory Dumps
Identifies suspicious ProcDump usage with dump flags and LSASS-related markers to indicate potential credential harvesting.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2018-10-30
- Updated
- 2026-07-30
ATT&CK techniques
Defense Evasion → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line includes ProcDump dump flags (-ma, -mm, -mp) combined with LSASS-related process markers (e.g., "ls", "keyiso", "samss"). Dumping LSASS memory can expose sensitive authentication material, enabling credential theft for follow-on access. The detection relies on process creation telemetry, specifically the command line content.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sysinternals/downloads/procdump
- research.splunk.comhttps://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002
- x.comhttps://x.com/wietze/status/1958302556033065292?s=12
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows ProcDump Command Lines Targeting LSASS Memory Dumps
id: 17f1a61b-a091-43d8-8a32-3564555bec26
status: stable
description: This rule flags Windows process creation events where the command line includes ProcDump dump flags (-ma, -mm, -mp) combined with LSASS-related process markers (e.g., "ls", "keyiso", "samss"). Dumping LSASS memory can expose sensitive authentication material, enabling credential theft for follow-on access. The detection relies on process creation telemetry, specifically the command line content.
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
- https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002
- https://x.com/wietze/status/1958302556033065292?s=12
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-10-30
modified: 2025-10-19
tags:
- attack.stealth
- attack.t1036
- attack.credential-access
- attack.t1003.001
- car.2013-05-009
logsource:
category: process_creation
product: windows
detection:
selection_flags:
CommandLine|contains|windash:
- " -ma "
- " -mm "
- " -mp "
selection_process:
CommandLine|contains:
- " ls"
- " keyiso"
- " samss"
condition: all of selection_*
falsepositives:
- Unlikely, because no one should dump an lsass process memory
- Another tool that uses command line flags similar to ProcDump
level: high
license: DRL-1.1
related:
- id: 5afee48e-67dd-4e03-a783-f74259dcf998
type: derived