Sigma detection rules, expert-reviewed

Malicious LSASS Credential Dump via ProcDump (via process_creation)

This rule detects ProcDump being used to create a full memory dump of the LSASS process, a credential access technique observed in the Agrius MoneyBird intrusions against Israeli organizations. Adversaries dump LSASS to harvest cached credentials and enable lateral movement, so this activity strongly indicates hands-on-keyboard compromise.

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

This rule detects rundll32 executing comsvcs.dll against the LSASS process to extract credentials from memory, a technique used by Salt Typhoon. Dumping LSASS provides hashed or plaintext credentials for lateral movement.

Malicious LSASS Dump via Process Access (via process_access)

This rule detects attempt to dump LSASS process with tools like Mimikatz.

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

This rule detects attempt to dump the LSASS process via the Task Manager.

Suspicious LSASS Credential Dump with LSASSY - PowerShell (via powershell)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

Malicious LSASS Credential Dump with LSASSY - Kernel Access (via security)

This rule detects remotely dump LSASS credentials using the LSASSY tool.

Malicious LSASS Memory Access From a Non-System Process (via process_access)

This rule detects a process opening a handle to LSASS with memory-read access rights typical of credential-dumping tooling, while excluding the small set of legitimate operating-system components that normally interact with LSASS. Access to LSASS memory is a top credential-access technique in the Red Canary Threat Detection Report, yielding plaintext secrets and hashes for lateral movement. Alerting on non-system readers of LSASS surfaces dumping attempts across custom and off-the-shelf tools.

Renamed Procdump Tool Used for Dumping LSASS Process (via process_creation)

This rule detects dump the LSASS process content using a renamed version of the Procdump tool.

Malicious LSASS Process Dump by a Non System Account (via security)

This rule detects will dump the LSASS memory content using tools like Mimikatz, ProcDump, TaskMgr, ...

Malicious LSASS Memory Dump via dllhost with comsvcs MiniDump Arguments (via process_creation)

This rule detects dllhost.exe dumping LSASS memory using comsvcs-style MiniDump arguments, the credential-theft step observed in the intrusion where a CLFS zero-day was exploited before ransomware deployment. Adversaries dump LSASS to c:\programdata to harvest credentials for lateral movement ahead of encryption, so dllhost invoking a MiniDump against lsass is a high-confidence credential-access indicator.

Malicious LSASS Credential Dumping via Mimikatz sekurlsa and lsadump Commands (via process_creation)

This rule detects Mimikatz command modules such as sekurlsa logonPasswords and lsadump sam being passed on the command line, the credential-access step in the ELPACO-team Confluence intrusion where logon passwords and SAM secrets were harvested to a results log. Adversaries run these Mimikatz modules to extract plaintext and hashed credentials from memory and the registry, so these module strings are a high-confidence dumping indicator regardless of the binary name.

Malicious LSASS Credentials Dump via Task Manager - File (via file_creation)

This rule detects provides an indicator of a user accessing the task manager in order to eventually dump the LSASS process content using the "Details" tab > right click on "lsass.exe" > Create a dump file.

Malicious LSASS Credential Dumping via Comsvcs MiniDump (via process_creation)

This rule detects the use of the built-in comsvcs.dll MiniDump export (typically invoked through rundll32) to write a memory dump of a target process such as LSASS to disk. Credential access via LSASS memory is a top technique in the Red Canary Threat Detection Report, giving adversaries plaintext credentials and hashes for lateral movement. Because this pattern relies on a signed system DLL, detecting the comsvcs MiniDump invocation surfaces stealthy credential theft.