Windows: Detect XORDump Utility Launch With LSASS Dump and Debug Module Switches
Alerts on xordump.exe spawning with LSASS-targeting and dump-module switches indicative of credential theft.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-28
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies suspicious execution of the XORDump utility when the process command line includes arguments targeting lsass.exe and loading multiple debug-related modules. Attackers commonly use process dumping to extract credentials from protected processes, making these specific command-line patterns a high-signal indicator. The detection relies on Windows process creation telemetry, matching the executable name and required substrings in the command line.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect XORDump Utility Launch With LSASS Dump and Debug Module Switches"
id: 414dc887-f57f-4f6d-bf81-236467882aa0
status: test
description: This rule identifies suspicious execution of the XORDump utility when the process command line includes arguments targeting lsass.exe and loading multiple debug-related modules. Attackers commonly use process dumping to extract credentials from protected processes, making these specific command-line patterns a high-signal indicator. The detection relies on Windows process creation telemetry, matching the executable name and required substrings in the command line.
references:
- https://github.com/audibleblink/xordump
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_xordump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-28
modified: 2023-02-08
tags:
- attack.stealth
- attack.t1036
- attack.t1003.001
- attack.credential-access
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \xordump.exe
- CommandLine|contains:
- " -process lsass.exe "
- " -m comsvcs "
- " -m dbghelp "
- " -m dbgcore "
condition: selection
falsepositives:
- Another tool that uses the command line switches of XORdump
level: high
license: DRL-1.1
related:
- id: 66e563f9-1cbd-4a22-a957-d8b7c0f44372
type: derived