Windows Process Creation: LSASS .dmp/related Dump Keywords in Command Line

title: "Windows Process Creation: LSASS .dmp/related Dump Keywords in Command Line"
id: 85bcc0fd-5f48-4dc2-b5a5-474567a25e15
related:
  - id: a5a2d357-1ab8-4675-a967-ef9990a59391
    type: derived
  - id: ffa6861c-4461-4f59-8a41-578c39f3f23e
    type: derived
status: test
description: This rule flags Windows process creation events where the command line contains LSASS dump-related filename keywords such as lsass.dmp and common archive/dump variants. Attackers may use these tools or parameters to create a memory dump of the lsass process, which can enable credential theft. The detection relies on process_creation telemetry with access to the full CommandLine field.
references:
  - https://github.com/Hackndo/lsassy
  - https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf
  - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml
  - https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/
  - https://github.com/helpsystems/nanodump
  - https://github.com/CCob/MirrorDump
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml
author: E.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-24
modified: 2023-08-29
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|contains:
        - lsass.dmp
        - lsass.zip
        - lsass.rar
        - Andrew.dmp
        - Coredump.dmp
        - NotLSASS.zip
        - lsass_2
        - lsassdump
        - lsassdmp
    - CommandLine|contains|all:
        - lsass
        - .dmp
    - CommandLine|contains|all:
        - SQLDmpr
        - .mdmp
    - CommandLine|contains|all:
        - nanodump
        - .dmp
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1