Windows Process Creation: LSASS .dmp/related Dump Keywords in Command Line
Alerts on Windows command lines containing LSASS dump keywords and .dmp/MDMP/zip/rar variants.
- Product
- windows
- Category
- process_creation
- Author
- E.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-10-24
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line contains LSASS dump-related filename keywords such as lsass.dmp and common archive/dump variants. Attackers may use these tools or parameters to create a memory dump of the lsass process, which can enable credential theft. The detection relies on process_creation telemetry with access to the full CommandLine field.
Reporting behind it
- github.comhttps://github.com/Hackndo/lsassy
- medium.comhttps://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf
- github.comhttps://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml
- whiteoaksecurity.comhttps://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/
- github.comhttps://github.com/helpsystems/nanodump
- github.comhttps://github.com/CCob/MirrorDump
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: LSASS .dmp/related Dump Keywords in Command Line"
id: 85bcc0fd-5f48-4dc2-b5a5-474567a25e15
related:
- id: a5a2d357-1ab8-4675-a967-ef9990a59391
type: derived
- id: ffa6861c-4461-4f59-8a41-578c39f3f23e
type: derived
status: test
description: This rule flags Windows process creation events where the command line contains LSASS dump-related filename keywords such as lsass.dmp and common archive/dump variants. Attackers may use these tools or parameters to create a memory dump of the lsass process, which can enable credential theft. The detection relies on process_creation telemetry with access to the full CommandLine field.
references:
- https://github.com/Hackndo/lsassy
- https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf
- https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml
- https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/
- https://github.com/helpsystems/nanodump
- https://github.com/CCob/MirrorDump
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml
author: E.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-24
modified: 2023-08-29
tags:
- attack.credential-access
- attack.t1003.001
logsource:
category: process_creation
product: windows
detection:
selection:
- CommandLine|contains:
- lsass.dmp
- lsass.zip
- lsass.rar
- Andrew.dmp
- Coredump.dmp
- NotLSASS.zip
- lsass_2
- lsassdump
- lsassdmp
- CommandLine|contains|all:
- lsass
- .dmp
- CommandLine|contains|all:
- SQLDmpr
- .mdmp
- CommandLine|contains|all:
- nanodump
- .dmp
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1