huntrule

Windows Process Creation: TrolleyExpress.exe Path Used to Dump LSASS Memory

Alerts on command lines using TrolleyExpress.exe PID parameters consistent with LSASS memory dumping on Windows.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: TrolleyExpress.exe Path Used to Dump LSASS Memory"
id: e3a3ba30-46e1-44bf-926d-f06f72bb53a2
status: test
description: This rule flags Windows process creation events where the command line references Citrix TrolleyExpress.exe with PID-style arguments indicative of a memory dump targeting LSASS. Attackers may rely on a trusted-looking executable name to access process memory for credential theft. The detection relies on process creation telemetry, matching command-line substrings and the process image ending with TrolleyExpress.exe, with exclusions based on OriginalFileName values.
references:
  - https://twitter.com/_xpn_/status/1491557187168178176
  - https://www.youtube.com/watch?v=Ie831jF0bb0
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_citrix_trolleyexpress_procdump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-10
modified: 2022-05-13
tags:
  - attack.stealth
  - attack.t1218.011
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - \TrolleyExpress 7
      - \TrolleyExpress 8
      - \TrolleyExpress 9
      - \TrolleyExpress.exe 7
      - \TrolleyExpress.exe 8
      - \TrolleyExpress.exe 9
      - "\\TrolleyExpress.exe -ma "
  renamed:
    Image|endswith: \TrolleyExpress.exe
  filter_renamed:
    OriginalFileName|contains: CtxInstall
  filter_empty:
    OriginalFileName: null
  condition: selection or ( renamed and not 1 of filter* )
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4c0aaedc-154c-4427-ada0-d80ef9c9deb6
    type: derived

What it detects

This rule flags Windows process creation events where the command line references Citrix TrolleyExpress.exe with PID-style arguments indicative of a memory dump targeting LSASS. Attackers may rely on a trusted-looking executable name to access process memory for credential theft. The detection relies on process creation telemetry, matching command-line substrings and the process image ending with TrolleyExpress.exe, with exclusions based on OriginalFileName values.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.