Sigma detection rules, expert-reviewed

Windows: Unsigned DLL/EXE Image Loaded Into lsass.exe

Alerts on image loads into lsass.exe where the loaded image is unsigned.

Windows Security Log LSASS Access by Non-Computer Account Process

Alerts on suspicious LSASS access attempts (4663/4656) targeting lsass.exe by non-system processes using flagged access masks.

WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Flags remote WinRM (wsmprovhost.exe) process-access to lsass.exe, a high-risk credential-access behavior.

Windows Process Creation: Alert on Suspicious Parent of Core System Executables

Flags when core Windows executables (e.g., svchost, lsass, winlogon) are spawned by suspicious parent processes.

Windows ProcDump Command Lines Targeting LSASS Memory Dumps

Identifies suspicious ProcDump usage with dump flags and LSASS-related markers to indicate potential credential harvesting.

Windows LSASS process access blocked by Attack Surface Reduction (Windows Defender event 1121)

Alerts on windefend EventID 1121 for blocked access to lsass.exe, excluding common benign process callers.

Windows: SafetyKatz LSASS dump default file indicator (Temp\debug.bin)

Flags Windows file events with a target path ending in \Temp\debug.bin, consistent with SafetyKatz LSASS dump output.

Windows LSASS Remote Thread Creation Indicative of Password Dumping

Flags Windows remote thread creation targeting lsass.exe, a common pattern in password dumping activity.

Windows Security: Detect LSASS handle access for SAM_DOMAIN (0x705)

Flags handle opens to lsass.exe with access mask 0x705 targeting SAM_DOMAIN, indicative of credential dumping.

Windows WerFault Access to lsass.exe Indicative of Credential Dumping Attempts

Alert on WerFault.exe gaining broad access to lsass.exe, consistent with credential dumping attempts.