Sigma detection rules, expert-reviewed

Windows Process Creation: AsperaFaspex Parent Spawning PowerShell or Credential-Access Tooling

Detects AsperaFaspex (aspera\ruby parent) spawning suspicious PowerShell, LSASS, web download, privilege, or defensive-evasion commands on Windows.

Windows Registry: LSASS Full Dump via WER LocalDumps DumpType=2

Flags registry changes enabling LSASS full memory dumps by setting WER LocalDumps DumpType to 0x2.

Windows: LSASS Dump (.dmp) Files in CrashDumps Folder

Alerts when an lsass.exe dump (.dmp) appears in the Windows CrashDumps directory under systemprofile.

Windows Application Error: LSASS (lsass.exe) Crashed (Event ID 1000)

Alerts on Application Error (Event ID 1000) entries where lsass.exe crashes, using Windows Application event telemetry.

Windows Process Execution of HandleKatz LSASS Dumper (loader.exe)

Flags HandleKatz-style loader.exe executions that dump LSASS into obfuscated .obf files using --pid and --outfile.

Windows: findstr.exe LSASS keyword matching for process reconnaissance

Alert on find.exe/findstr.exe command lines containing "lsass", indicating potential LSASS-focused reconnaissance.

Windows Registry: LSA Extensions Multi-SZ DLL Persistence (REG_MULTI_SZ)

Alerts on registry edits to LSA extension DLL entries under LsaSrv\Extensions that can support persistence through lsass.exe loading.

Windows: Suspicious LSASS handle access via svchost.exe call trace to seclogon.dll

Flags svchost.exe attempting LSASS access (granted access 0x14c0) with seclogon.dll in the call trace.

WerFault lsass.exe access indicating credential dumping attempts on Windows

Alert on WerFault.exe gaining broad access to lsass.exe, consistent with credential dumping attempts.

Windows HandleKatz: Duplicate LSASS Handle via Process Access with Handle Duplication Rights

Flags HandleKatz-style behavior duplicating an existing LSASS handle using PROCESS_DUP_HANDLE and ntdll.dll call trace.

Windows WerFault LSASS Memory Dump File Creation

Flags WerFault dump creation where the dump filename suggests it contains LSASS memory.

Windows HackTool Process Patterns for CrackMapExec LSASS Dumping

Alerts on Windows command-line process patterns consistent with LSASS dumping in CrackMapExec workflows.

Windows Process Access Indicates Potential Shellcode Injection via LSASS

Alerts on high-privilege process access from wmiprvse.exe to lsass.exe consistent with potential shellcode injection behavior.

Windows Process Creation: TrolleyExpress.exe Used to Access lsass Memory (PID Parameters)

Alerts on command lines using TrolleyExpress.exe PID parameters consistent with LSASS memory dumping on Windows.

Windows LSASS memory access from TrolleyExpress/ProcessDump/dump64 processes

Alerts on Windows processes attempting to access lsass.exe from TrolleyExpress.exe, ProcessDump.exe, or dump64.exe with dump-like access rights.