Windows HackTool Process Patterns for CrackMapExec LSASS Dumping
Alerts on Windows command-line process patterns consistent with LSASS dumping in CrackMapExec workflows.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-03-12
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events whose command lines and user strings match patterns associated with credential-access tooling attempting to dump LSASS. It matters because attackers often use LSASS memory contents to obtain credential material. The detection relies on telemetry containing process command lines and process execution context, such as command-line arguments invoking tasklist/cmd and use of rundll32 with comsvcs.dll MiniDump, plus checks for temporary-path and output patterns.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows HackTool Process Patterns for CrackMapExec LSASS Dumping
id: aabd8db8-f013-42aa-8796-42b7220c941e
status: test
description: This rule flags Windows process creation events whose command lines and user strings match patterns associated with credential-access tooling attempting to dump LSASS. It matters because attackers often use LSASS memory contents to obtain credential material. The detection relies on telemetry containing process command lines and process execution context, such as command-line arguments invoking tasklist/cmd and use of rundll32 with comsvcs.dll MiniDump, plus checks for temporary-path and output patterns.
references:
- https://mpgn.gitbook.io/crackmapexec/smb-protocol/obtaining-credentials/dump-lsass
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_patterns.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-12
modified: 2023-02-13
tags:
- attack.credential-access
- attack.t1003.001
logsource:
product: windows
category: process_creation
detection:
selection_lsass_dump1:
CommandLine|contains|all:
- "tasklist /fi "
- Imagename eq lsass.exe
CommandLine|contains:
- "cmd.exe /c "
- "cmd.exe /r "
- "cmd.exe /k "
- "cmd /c "
- "cmd /r "
- "cmd /k "
User|contains:
- AUTHORI
- AUTORI
selection_lsass_dump2:
CommandLine|contains|all:
- do rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump
- \Windows\Temp\
- " full"
- "%%B"
selection_procdump:
CommandLine|contains|all:
- tasklist /v /fo csv
- findstr /i "lsass"
condition: 1 of selection*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f26307d8-14cd-47e3-a26b-4b4769f24af6
type: derived