{"id":"a5a2d357-1ab8-4675-a967-ef9990a59391","title":"LSASS Process Memory Dump Files","description":"Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-11-15","modified":"2024-10-08","tags":["attack.credential-access","attack.t1003.001"],"technique_ids":["T1003.001"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Unknown"],"references":["https://www.google.com/search?q=procdump+lsass","https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf","https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml","https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/","https://github.com/helpsystems/nanodump","https://github.com/CCob/MirrorDump","https://github.com/safedv/RustiveDump/blob/1a9b026b477587becfb62df9677cede619d42030/src/main.rs#L35","https://github.com/ricardojoserf/NativeDump/blob/01d8cd17f31f51f5955a38e85cd3c83a17596175/NativeDump/Program.cs#L258"],"source_path":"rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml","source_sha256":"d93454fad0d02f3ba05215b5682e65a6fefcd28b37a546419e47693d28477df5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: LSASS Process Memory Dump Files\nid: a5a2d357-1ab8-4675-a967-ef9990a59391\nrelated:\n    - id: db2110f3-479d-42a6-94fb-d35bc1e46492\n      type: obsolete\n    - id: 5e3d3601-0662-4af0-b1d2-36a05e90c40a\n      type: obsolete\nstatus: test\ndescription: Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.\nreferences:\n    - https://www.google.com/search?q=procdump+lsass\n    - https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf\n    - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml\n    - https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/\n    - https://github.com/helpsystems/nanodump\n    - https://github.com/CCob/MirrorDump\n    - https://github.com/safedv/RustiveDump/blob/1a9b026b477587becfb62df9677cede619d42030/src/main.rs#L35\n    - https://github.com/ricardojoserf/NativeDump/blob/01d8cd17f31f51f5955a38e85cd3c83a17596175/NativeDump/Program.cs#L258\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-11-15\nmodified: 2024-10-08\ntags:\n    - attack.credential-access\n    - attack.t1003.001\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection_1:\n        TargetFilename|endswith:\n            - '\\Andrew.dmp'\n            - '\\Coredump.dmp'\n            - '\\lsass.dmp'\n            - '\\lsass.rar'\n            - '\\lsass.zip'\n            - '\\NotLSASS.zip'  # https://github.com/CCob/MirrorDump\n            - '\\PPLBlade.dmp'  # https://github.com/tastypepperoni/PPLBlade\n            - '\\rustive.dmp' # https://github.com/safedv/RustiveDump/blob/main/src/main.rs#L35\n    selection_2:\n        TargetFilename|contains:\n            - '\\lsass_2'  # default format of procdump v9.0 is lsass_YYMMDD_HHmmss.dmp\n            - '\\lsassdmp'\n            - '\\lsassdump'\n    selection_3:\n        TargetFilename|contains|all:\n            - '\\lsass'\n            - '.dmp'\n    selection_4:\n        TargetFilename|contains: 'SQLDmpr'\n        TargetFilename|endswith: '.mdmp'\n    selection_5:\n        TargetFilename|contains:\n            - '\\nanodump'\n            - '\\proc_' # NativeDump pattern https://github.com/ricardojoserf/NativeDump/blob/01d8cd17f31f51f5955a38e85cd3c83a17596175/NativeDump/Program.cs#L258\n        TargetFilename|endswith: '.dmp'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/a5a2d357-1ab8-4675-a967-ef9990a59391.json","kind":"sigma"}