Title:
Potential LSASS Process Dump Via Procdump
Status:
stable
Description:Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump.
This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers.
LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory.
Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.
References:
-https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
-https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002
-https://x.com/wietze/status/1958302556033065292?s=12
Author: Florian Roth (Nextron Systems)
Date: 2018-10-30
modified:2025-10-19
Tags:
- -'attack.stealth'
- -'attack.t1036'
- -'attack.credential-access'
- -'attack.t1003.001'
- -'car.2013-05-009'
Logsource:
- category: process_creation
- product: windows
Detection:
selection_flags:
CommandLine|contains|windash:
-' -ma '
-' -mm '
-' -mp '
selection_process:
CommandLine|contains:
-' ls'
-' keyiso'
-' samss'
condition:
all of selection_*
Falsepositives:
-Unlikely, because no one should dump an lsass process memory
-Another tool that uses command line flags similar to ProcDump
Level:
high
