Windows Process Creation: TrolleyExpress.exe Used to Access lsass Memory (PID Parameters)
Alerts on command lines using TrolleyExpress.exe PID parameters consistent with LSASS memory dumping on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-02-10
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line includes TrolleyExpress.exe (or the path fragment) with parameters consistent with dumping another process by PID, specifically PID values in the 700–999 range. Using a whitelisted binary name to stage credential-access activity matters because it may help evade naive allowlists while attempting to obtain lsass memory contents. The detection relies on process creation telemetry, matching command-line substrings and confirming the image ends with TrolleyExpress.exe, while excluding cases based on OriginalFileName content.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: TrolleyExpress.exe Used to Access lsass Memory (PID Parameters)"
id: e3a3ba30-46e1-44bf-926d-f06f72bb53a2
status: test
description: This rule flags Windows process creation events where the command line includes TrolleyExpress.exe (or the path fragment) with parameters consistent with dumping another process by PID, specifically PID values in the 700–999 range. Using a whitelisted binary name to stage credential-access activity matters because it may help evade naive allowlists while attempting to obtain lsass memory contents. The detection relies on process creation telemetry, matching command-line substrings and confirming the image ends with TrolleyExpress.exe, while excluding cases based on OriginalFileName content.
references:
- https://twitter.com/_xpn_/status/1491557187168178176
- https://www.youtube.com/watch?v=Ie831jF0bb0
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_citrix_trolleyexpress_procdump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-10
modified: 2022-05-13
tags:
- attack.stealth
- attack.t1218.011
- attack.credential-access
- attack.t1003.001
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- \TrolleyExpress 7
- \TrolleyExpress 8
- \TrolleyExpress 9
- \TrolleyExpress.exe 7
- \TrolleyExpress.exe 8
- \TrolleyExpress.exe 9
- "\\TrolleyExpress.exe -ma "
renamed:
Image|endswith: \TrolleyExpress.exe
filter_renamed:
OriginalFileName|contains: CtxInstall
filter_empty:
OriginalFileName: null
condition: selection or ( renamed and not 1 of filter* )
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 4c0aaedc-154c-4427-ada0-d80ef9c9deb6
type: derived