Windows Taskmgr.exe Creating lsass.dmp in Temp Directory

Alerts when Task Manager creates a Temp lsass .DMP file consistent with LSASS memory dumping.

FreeUnreviewedSigmahighv1

windows-taskmgr-exe-creating-lsass-dmp-in-temp-directory-69ca12af

title: Windows Taskmgr.exe Creating lsass.dmp in Temp Directory
id: 3172217d-cb45-4572-a81a-27e61096cc28
status: test
description: This rule flags file creation events where taskmgr.exe writes a file under AppData\Local\Temp that contains "lsass" and ends with ".DMP". Dumping LSASS memory is a common credential-access technique because it can expose authentication material. The detection relies on Windows file event telemetry capturing the writing process image (taskmgr.exe) and the target filename/path.
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2023-10-19
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1003.001/T1003.001.md#L1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump.yml
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - :\Windows\system32\taskmgr.exe
      - :\Windows\SysWOW64\taskmgr.exe
    TargetFilename|contains|all:
      - \AppData\Local\Temp\
      - \lsass
      - .DMP
  condition: selection
falsepositives:
  - Rare case of troubleshooting by an administrator or support that has to be investigated regardless
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump/info.yml
license: DRL-1.1
related:
  - id: 69ca12af-119d-44ed-b50f-a47af0ebc364
    type: derived

What it detects

This rule flags file creation events where taskmgr.exe writes a file under AppData\Local\Temp that contains "lsass" and ends with ".DMP". Dumping LSASS memory is a common credential-access technique because it can expose authentication material. The detection relies on Windows file event telemetry capturing the writing process image (taskmgr.exe) and the target filename/path.

Known false positives

Rare case of troubleshooting by an administrator or support that has to be investigated regardless

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.