huntrule

Windows process pattern indicating CrackMapExec LSASS dumping via tasklist, cmd, and rundll32

Alerts on Windows command-line process patterns consistent with LSASS dumping in CrackMapExec workflows.

FreeUnreviewedSigmahighv1
title: Windows process pattern indicating CrackMapExec LSASS dumping via tasklist, cmd, and rundll32
id: aabd8db8-f013-42aa-8796-42b7220c941e
status: test
description: This rule flags Windows process creation events where command lines show patterns consistent with dumping the LSASS process (lsass.exe) using tasklist-based checks and related command execution. Such activity is commonly used to access credential material and is a high-signal precursor to credential dumping or lateral movement. It relies on telemetry from Windows process creation logs, matching specific command-line substrings that reference cmd usage, rundll32 with comsvcs.dll MiniDump, and tasklist/findstr queries for lsass.
references:
  - https://mpgn.gitbook.io/crackmapexec/smb-protocol/obtaining-credentials/dump-lsass
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_patterns.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-12
modified: 2023-02-13
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_lsass_dump1:
    CommandLine|contains|all:
      - "tasklist /fi "
      - Imagename eq lsass.exe
    CommandLine|contains:
      - "cmd.exe /c "
      - "cmd.exe /r "
      - "cmd.exe /k "
      - "cmd /c "
      - "cmd /r "
      - "cmd /k "
    User|contains:
      - AUTHORI
      - AUTORI
  selection_lsass_dump2:
    CommandLine|contains|all:
      - do rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump
      - \Windows\Temp\
      - " full"
      - "%%B"
  selection_procdump:
    CommandLine|contains|all:
      - tasklist /v /fo csv
      - findstr /i "lsass"
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f26307d8-14cd-47e3-a26b-4b4769f24af6
    type: derived

What it detects

This rule flags Windows process creation events where command lines show patterns consistent with dumping the LSASS process (lsass.exe) using tasklist-based checks and related command execution. Such activity is commonly used to access credential material and is a high-signal precursor to credential dumping or lateral movement. It relies on telemetry from Windows process creation logs, matching specific command-line substrings that reference cmd usage, rundll32 with comsvcs.dll MiniDump, and tasklist/findstr queries for lsass.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.