Every published rule

Windows LSASS memory access from TrolleyExpress/ProcessDump/dump64 processes

Alerts on Windows processes attempting to access lsass.exe from TrolleyExpress.exe, ProcessDump.exe, or dump64.exe with dump-like access rights.

Windows LSASS Memory Access Triggered by Source Image Containing 'dump' Keyword

Alerts when a process named with 'dump' requests specific access rights to lsass.exe on Windows.

Windows: Detect XORDump Utility Launch With LSASS Dump and Debug Module Switches

Alerts on xordump.exe spawning with LSASS-targeting and dump-module switches indicative of credential theft.

Windows ProcDump renamed, copied or moved for stealth evasion

Alerts on ProcDump commands that copy/move or rename dump outputs, including LSASS dump filename patterns.

Windows LSASS Process Clone Execution Observed

Alerts on process creation where LSASS creates a new LSASS clone, which may indicate credential dumping activity.

Windows Process Access to LSASS Memory From Suspicious Source Paths

Alerts on processes attempting sensitive access to lsass.exe originating from suspicious/temp directories, using granted access and source path context.

Windows process access to LSASS.exe with suspicious GrantedAccess flags

Alerts on process access attempts to lsass.exe with GrantedAccess rights commonly linked to credential theft behavior.

Windows LSASS Memory Dump File Creation

Alerts on Windows file creation of LSASS memory dump artifacts identified by high-confidence filename patterns.

Windows Registry: lsass.exe Creating Local Hidden User Account Entries

Alerts when lsass.exe writes hidden local user name entries to the SAM\...\Users\Names\ registry path.

Windows PowerShell Get-Process or aliases targeting LSASS (lsas)

Alerts on PowerShell Get-Process/alias commands referencing LSASS in Windows process creation events.

Windows PowerShell: Get-Process querying lsass within a ScriptBlock

Alerts when PowerShell ScriptBlock text runs Get-Process against lsass, a common credential-access precursor.

Windows Registry: SilentProcessExit lsass.exe Monitor Registration for Credential Dumping

Alerts on registry registrations for SilentProcessExit monitoring of lsass.exe, a potential precursor to credential dumping.

Windows: rundll32 Triggering comsvcs.dll MiniDump Against lsass.exe

Detects rundll32 invoking comsvcs.dll to dump lsass.exe via a MiniDump export.

Windows PowerShell Remote Thread Into lsass.exe Suggesting Credential Dumping

Alerts when PowerShell creates a remote thread into lsass.exe, indicating possible credential dumping on Windows.

PowerShell Access to LSASS on Windows Suggesting Credential Dumping

Alerts when PowerShell (powershell.exe/pwsh.exe) accesses lsass.exe, indicating potential credential dumping.

Windows: Dumpert Process Dumper Execution via Dumpert.dll or Known MD5

Detects Dumpert execution on Windows via known hash and command line reference to Dumpert.dll for lsass memory dumping.

Windows Security: Suspicious AccessMask/AccessList Requested on LSASS (lsass.exe) Handle

Flags processes requesting potentially credential-dumping-related access to LSASS based on Security Event 4656/4663.

Windows Process Creation: LSASS .dmp/related Dump Keywords in Command Line

Alerts on Windows command lines containing LSASS dump keywords and .dmp/MDMP/zip/rar variants.

Uncommon Outbound Kerberos Port 88 Network Connections (Windows Security Event 5156)

Alerts on rare outbound Kerberos (port 88) connections from non-browser/non-lsass processes using Windows Event 5156.

Windows: Unsigned DLL/EXE Image Loaded Into lsass.exe

Alerts on image loads into lsass.exe where the loaded image is unsigned.