Sigma detection rules, expert-reviewed

Windows Security: Suspicious AccessMask on LSASS Handle Requests (4656/4663)

Flags processes requesting potentially credential-dumping-related access to LSASS based on Security Event 4656/4663.

Windows Process Creation: LSASS .dmp/related Dump Keywords in Command Line

Alerts on Windows command lines containing LSASS dump keywords and .dmp/MDMP/zip/rar variants.

Uncommon Outbound Kerberos Port 88 Network Connections (Windows Security Event 5156)

Alerts on rare outbound Kerberos (port 88) connections from non-browser/non-lsass processes using Windows Event 5156.

Windows: Unsigned DLL/EXE Image Loaded Into lsass.exe

Alerts on image loads into lsass.exe where the loaded image is unsigned.

Windows Security Event LSASS Process Access by Non-Computer Account

Alerts on suspicious LSASS access attempts (4663/4656) targeting lsass.exe by non-system processes using flagged access masks.

WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Flags remote WinRM (wsmprovhost.exe) process-access to lsass.exe, a high-risk credential-access behavior.

Windows Process Creation: Alert on Suspicious Parent of Core System Executables

Flags when core Windows executables (e.g., svchost, lsass, winlogon) are spawned by suspicious parent processes.

Windows ProcDump Command Lines Targeting LSASS Memory Dumps

Identifies suspicious ProcDump usage with dump flags and LSASS-related markers to indicate potential credential harvesting.

Windows LSASS process access blocked by Attack Surface Reduction (Windows Defender event 1121)

Alerts on windefend EventID 1121 for blocked access to lsass.exe, excluding common benign process callers.

Windows: SafetyKatz LSASS dump default file indicator (Temp\debug.bin)

Flags Windows file events with a target path ending in \Temp\debug.bin, consistent with SafetyKatz LSASS dump output.

Windows LSASS Remote Thread Creation Indicative of Password Dumping

Flags Windows remote thread creation targeting lsass.exe, a common pattern in password dumping activity.

Windows Security: Detect LSASS handle access for SAM_DOMAIN (0x705)

Flags handle opens to lsass.exe with access mask 0x705 targeting SAM_DOMAIN, indicative of credential dumping.