{"id":"5afee48e-67dd-4e03-a783-f74259dcf998","title":"Potential LSASS Process Dump Via Procdump","description":"Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump.\nThis rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers.\nLSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory.\nAttackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.\n","author":"Florian Roth (Nextron Systems)","status":"stable","level":"high","date":"2018-10-30","modified":"2025-10-19","tags":["attack.stealth","attack.t1036","attack.credential-access","attack.t1003.001","car.2013-05-009"],"technique_ids":["T1003.001","T1036"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely, because no one should dump an lsass process memory","Another tool that uses command line flags similar to ProcDump"],"references":["https://learn.microsoft.com/en-us/sysinternals/downloads/procdump","https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002","https://x.com/wietze/status/1958302556033065292?s=12"],"source_path":"rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml","source_sha256":"f75c2b4c77d1eda036e2b287816b7048b70544199fc0ef2a0418619586bc6d10","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential LSASS Process Dump Via Procdump\nid: 5afee48e-67dd-4e03-a783-f74259dcf998\nstatus: stable\ndescription: |\n    Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump.\n    This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers.\n    LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory.\n    Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.\nreferences:\n    - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump\n    - https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002\n    - https://x.com/wietze/status/1958302556033065292?s=12\nauthor: Florian Roth (Nextron Systems)\ndate: 2018-10-30\nmodified: 2025-10-19\ntags:\n    - attack.stealth\n    - attack.t1036\n    - attack.credential-access\n    - attack.t1003.001\n    - car.2013-05-009\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_flags:\n        CommandLine|contains|windash:\n            - ' -ma '\n            - ' -mm ' # Mini dump\n            - ' -mp ' # Miniplus dump\n    selection_process:\n        CommandLine|contains:\n            - ' ls' # Short for lsass\n            - ' keyiso'\n            - ' samss'\n    condition: all of selection_*\nfalsepositives:\n    - Unlikely, because no one should dump an lsass process memory\n    - Another tool that uses command line flags similar to ProcDump\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"},{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"}],"data_path":"data/detection-rules/5afee48e-67dd-4e03-a783-f74259dcf998.json","kind":"sigma"}