Sigma detection rules, expert-reviewed

Malicious LSASS Memory Dump via comsvcs.dll MiniDump

This rule detects rundll32 invoking the MiniDump export of comsvcs.dll to dump the memory of the LSASS process to disk. This technique was used by the FishMonger group during Operation FishMedley to harvest credentials from compromised hosts. Extracting LSASS memory gives attackers plaintext passwords and hashes for lateral movement and privilege escalation.

Malicious LSASS Memory Dump via procdump

This rule detects procdump being run against the lsass.exe process to capture a full memory dump, from which credentials can be extracted offline with tools such as mimikatz. This is one of the most common OS credential-dumping techniques.

Malicious LSASS Credential Dump via ProcDump (via process_creation)

This rule detects ProcDump being used to create a full memory dump of the LSASS process, a credential access technique observed in the Agrius MoneyBird intrusions against Israeli organizations. Adversaries dump LSASS to harvest cached credentials and enable lateral movement, so this activity strongly indicates hands-on-keyboard compromise.

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

This rule detects rundll32 executing comsvcs.dll against the LSASS process to extract credentials from memory, a technique used by Salt Typhoon. Dumping LSASS provides hashed or plaintext credentials for lateral movement.

Malicious LSASS Dump via Process Access (via process_access)

This rule detects attempt to dump LSASS process with tools like Mimikatz.

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

This rule detects attempt to dump the LSASS process via the Task Manager.

Suspicious LSASS Credential Dump with LSASSY - PowerShell (via powershell)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

Malicious LSASS Credential Dump with LSASSY - Kernel Access (via security)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

Malicious LSASS Memory Access From a Non-System Process (via process_access)

This rule detects a process opening a handle to LSASS with memory-read access rights typical of credential-dumping tooling, while excluding the small set of legitimate operating-system components that normally interact with LSASS. Access to LSASS memory is a top credential-access technique in the Red Canary Threat Detection Report, yielding plaintext secrets and hashes for lateral movement. Alerting on non-system readers of LSASS surfaces dumping attempts across custom and off-the-shelf tools.

Renamed Procdump Tool Used for Dumping LSASS Process (via process_creation)

This rule detects dump the LSASS process content using a renamed version of the Procdump tool.

Malicious LSASS Process Dump by a Non System Account (via security)

This rule detects will dump the LSASS memory content using tools like Mimikatz, ProcDump, TaskMgr, ...

Malicious LSASS Memory Dump via dllhost with comsvcs MiniDump Arguments (via process_creation)

This rule detects dllhost.exe dumping LSASS memory using comsvcs-style MiniDump arguments, the credential-theft step observed in the intrusion where a CLFS zero-day was exploited before ransomware deployment. Adversaries dump LSASS to c:\programdata to harvest credentials for lateral movement ahead of encryption, so dllhost invoking a MiniDump against lsass is a high-confidence credential-access indicator.

Malicious LSASS Credential Dumping via Mimikatz sekurlsa and lsadump Commands (via process_creation)

This rule detects Mimikatz command modules such as sekurlsa logonPasswords and lsadump sam being passed on the command line, the credential-access step in the ELPACO-team Confluence intrusion where logon passwords and SAM secrets were harvested to a results log. Adversaries run these Mimikatz modules to extract plaintext and hashed credentials from memory and the registry, so these module strings are a high-confidence dumping indicator regardless of the binary name.