HackTool - Doppelanger LSASS Dumper Execution

Title: HackTool - Doppelanger LSASS Dumper Execution
Status: experimental
Description:Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods
References:
  -https://labs.yarix.com/2025/06/doppelganger-an-advanced-lsass-dumper-with-process-cloning/
  -https://github.com/vari-sh/RedTeamGrimoire/tree/668e0357072546065729ad623f8c02f7be21bb08/Doppelganger
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-01
modified:None
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\Doppelganger.exe'     - Hashes|contains:
      - 'IMPHASH=AB94D5217896ADCD765A06B2D52F0AEB'
      - 'IMPHASH=65F0EA61156EE0C2A35421926F0C7F78'
  condition:selection
Falsepositives:
  -Unknown
Level: high