Sigma detection rules, expert-reviewed

Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)

This rule detects rundll32.exe invoking the comsvcs.dll MiniDump export to dump process memory, the LOLBin credential-theft technique Red Canary highlights for extracting secrets from LSASS. This is a well-known method to harvest credentials while blending in with a signed system binary, and its use is almost always malicious.

Suspicious LSASS Credential Access via PowerShell (via process_creation)

This rule detects PowerShell command lines referencing lsass, the mechanism the extortion actor used to dump credentials from the Local Security Authority Subsystem Service memory. Reading or dumping LSASS through PowerShell exposes plaintext credentials and hashes for lateral movement.

Suspicious LSASS Memory Dump via Task Manager After Ivanti Exploitation

This rule detects Task Manager being used to create a memory dump of the LSASS process, matching credential access observed after Ivanti appliance exploitation by Unit 42. Adversaries dump LSASS through the built-in Taskmgr interface to harvest credentials while avoiding known dumping tools which enables further lateral movement.

Suspicious ProcDump LSASS Memory Dump via process_creation

This rule detects use of ProcDump to capture the memory of the LSASS process for offline credential extraction. Alloy Taurus operators dumped LSASS with ProcDump during their campaign against a Southeast Asian government target, and while ProcDump is a legitimate Sysinternals tool this specific target makes it a strong credential-access signal.

Suspicious LSASS Memory Dump via Procdump Process Creation

This rule detects Procdump being run against the LSASS process to capture a memory dump for offline credential extraction, a technique used by the North Korean actor Moonstone Sleet during intrusions. Dumping LSASS yields plaintext and hashed credentials that enable lateral movement and privilege escalation.

Malicious LSASS Memory Dump via procdump

This rule detects procdump creating a full memory dump of the lsass.exe process to harvest credentials, as performed in the StrikeShark campaign. Dumping LSASS memory yields plaintext and hashed credentials for lateral movement. This is a strong credential-access indicator even though procdump is a legitimate Sysinternals tool.

Suspicious LSASS Process Enumeration via tasklist Filter

This rule detects tasklist being filtered for the lsass process, a reconnaissance step used before credential dumping in the 2025 NTLM abuse activity. Attackers query tasklist and filter for lsass to obtain its process id ahead of a memory dump. While administrators occasionally enumerate processes, specifically targeting lsass by name is a suspicious precursor to credential access.

Malicious LSASS Credential Dump via rundll32 and comsvcs MiniDump

This rule detects rundll32 invoking the comsvcs.dll MiniDump export to dump the memory of LSASS, a credential theft technique observed in the 2025 NTLM abuse campaigns. Attackers call comsvcs.dll MiniDump against the LSASS process id to write its memory to disk and later extract secrets. This is a well-established living-off-the-land method for harvesting cached credentials and NTLM hashes.

Malicious LSASS Memory Dump via dllhost ProcDump Masquerade (via process_creation)

This rule detects a process named dllhost.exe running with ProcDump style arguments to create a full memory dump of lsass.exe as observed with the PipeMagic backdoor. The genuine dllhost COM surrogate never accepts these switches so this is a renamed ProcDump used to steal credentials from LSASS. Capturing LSASS memory yields hashes and tickets for further compromise.

Malicious LSASS Credential Extraction via Mimikatz sekurlsa

This rule detects Mimikatz sekurlsa module commands used to extract credentials from LSASS memory or a minidump. The Crypt Ghouls group ran sekurlsa minidump against an lsass.dmp to recover plaintext passwords and hashes for privilege escalation.

Malicious LSASS Memory Dump via Comsvcs MiniDump

This rule detects rundll32 invoking the comsvcs.dll MiniDump export against a process, the living-off-the-land technique used by the profiled APT actors to dump LSASS memory. Extracting the LSASS process image yields credentials for lateral movement without dropping a dedicated dumping tool. This command pattern has virtually no legitimate use.

Suspicious LSASS Memory Dump via Renamed ProcDump (via process_creation)

This rule detects a ProcDump-style full memory dump of the lsass process regardless of the binary name on disk. The BadPilot campaign renames procdump and invokes it with the full-dump and accept-eula switches against lsass to harvest credentials, so this command-line pattern captures the technique even when the tool is renamed.

Malicious LSASS Memory Dump via Rundll32 and Comsvcs MiniDump

This rule detects rundll32.exe invoking comsvcs.dll MiniDump to dump process memory, the classic LSASS credential-theft technique that remained in use across the 2025 intrusions Huntress reviewed. Dumping LSASS extracts cached credentials and Kerberos material for lateral movement. The combination of comsvcs.dll and the MiniDump export from rundll32 has virtually no legitimate use on endpoints.

Malicious LSASS Memory Dump via PowerShell

This rule detects PowerShell dumping the LSASS process memory to harvest credentials. During the Christmas Miracle incident the actor used PowerShell to create an LSASS memory dump for offline credential extraction. Access to LSASS memory yields plaintext and hashed credentials for lateral movement.

Malicious LSASS Memory Dump via Procdump

This rule detects a full memory dump of lsass.exe requested on the command line which APT41 performs with procdump to extract cleartext credentials and hashes. The dumped process memory is exfiltrated and parsed offline with Mimikatz. Detecting it exposes an active credential theft attempt against the LSA subsystem.