Sigma detection rules, expert-reviewed

Windows LSASS Memory Access Triggered by Source Image Containing 'dump' Keyword

Alerts when a process named with 'dump' requests specific access rights to lsass.exe on Windows.

Windows: Detect XORDump Utility Launch With LSASS Dump and Debug Module Switches

Alerts on xordump.exe spawning with LSASS-targeting and dump-module switches indicative of credential theft.

Windows ProcDump renamed, copied or moved for stealth evasion

Alerts on ProcDump commands that copy/move or rename dump outputs, including LSASS dump filename patterns.

Windows LSASS Process Clone Execution Observed

Alerts on process creation where LSASS creates a new LSASS clone, which may indicate credential dumping activity.

Windows LSASS Memory Access via Process Access Flags From Suspicious Paths

Alerts on processes attempting sensitive access to lsass.exe originating from suspicious/temp directories, using granted access and source path context.

Windows Process Access: Suspicious GrantedAccess Flags Targeting lsass.exe

Alerts on process access attempts to lsass.exe with GrantedAccess rights commonly linked to credential theft behavior.

Windows LSASS Memory Dump File Creation

Alerts on Windows file creation of LSASS memory dump artifacts identified by high-confidence filename patterns.

Windows Registry: lsass.exe Creating Local Hidden User Account Entries

Alerts when lsass.exe writes hidden local user name entries to the SAM\...\Users\Names\ registry path.

Windows PowerShell Get-Process or aliases targeting LSASS (lsas)

Alerts on PowerShell Get-Process/alias commands referencing LSASS in Windows process creation events.

Windows PowerShell: Get-Process querying lsass within a ScriptBlock

Alerts when PowerShell ScriptBlock text runs Get-Process against lsass, a common credential-access precursor.

Windows Registry: SilentProcessExit lsass.exe Monitor Registration for Credential Dumping

Alerts on registry registrations for SilentProcessExit monitoring of lsass.exe, a potential precursor to credential dumping.

Windows: rundll32 Triggering comsvcs.dll MiniDump Against lsass.exe

Detects rundll32 invoking comsvcs.dll to dump lsass.exe via a MiniDump export.

Windows PowerShell Remote Thread Into lsass.exe Suggesting Credential Dumping

Alerts when PowerShell creates a remote thread into lsass.exe, indicating possible credential dumping on Windows.

PowerShell Access to LSASS on Windows Suggesting Credential Dumping

Alerts when PowerShell (powershell.exe/pwsh.exe) accesses lsass.exe, indicating potential credential dumping.

Windows HackTool: Dumpert Process Dumper Execution

Detects Dumpert execution on Windows via known hash and command line reference to Dumpert.dll for lsass memory dumping.