Windows: XORDump LSASS Memory Dump via Specific Command-Line Switches

title: "Windows: XORDump LSASS Memory Dump via Specific Command-Line Switches"
id: 414dc887-f57f-4f6d-bf81-236467882aa0
status: test
description: This rule flags process creation events where the executable name ends with xordump.exe and the command line includes switches used to target LSASS and load specific dump modules. Attackers may use XORDump to extract sensitive credentials by dumping the memory of lsass.exe, making this behavior high-risk. Detection relies on Windows process creation telemetry, including the Image name and full command-line arguments.
references:
  - https://github.com/audibleblink/xordump
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_xordump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-28
modified: 2023-02-08
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1003.001
  - attack.credential-access
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \xordump.exe
    - CommandLine|contains:
        - " -process lsass.exe "
        - " -m comsvcs "
        - " -m dbghelp "
        - " -m dbgcore "
  condition: selection
falsepositives:
  - Another tool that uses the command line switches of XORdump
level: high
license: DRL-1.1
related:
  - id: 66e563f9-1cbd-4a22-a957-d8b7c0f44372
    type: derived