OS Credential Dumping
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. This parent technique encompasses multiple sub-techniques targeting LSASS memory, SAM database, NTDS, LSA Secrets, cached domain credentials, DCSync, the Linux /proc filesystem, and /etc/passwd and /etc/shadow files. Credential material is subsequently used for lateral movement, privilege escalation, and persistent access. Widely used by APT groups including APT32, APT39, Ember Bear, BlackByte, Tonto Team, and Mustang Panda, as well as malware families such as Mimikatz, Carbanak, MgBot, and Revenge RAT.
What is T1003 OS Credential Dumping?
OS Credential Dumping (T1003) maps to the Credential Access tactic — the adversary is trying to steal account names and passwords in MITRE ATT&CK.
This page provides production-ready detection logic for OS Credential Dumping, covering the data sources and telemetry it touches: Process: Process Creation, Process: Process Access, File: File Access, Windows Registry: Windows Registry Key Access, Microsoft Defender for Endpoint. The queries below are rated critical severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1003 OS Credential Dumping
- Canonical reference
- https://attack.mitre.org/techniques/T1003/
let CredDumpTools = dynamic([
"mimikatz", "mimilib", "mimidrv",
"procdump", "procdump64",
"wce.exe", "pwdump", "fgdump",
"gsecdump", "cachedump", "lsadump",
"secretsdump", "impacket",
"crackmapexec", "safetydump",
"sharpdump", "sharpkatz",
"laZagne", "lazagne",
"nanodump", "handlekatz"
]);
let CredDumpArgs = dynamic([
"sekurlsa", "lsadump", "dcsync",
"logonpasswords", "wdigest", "kerberos",
"privilege::debug", "token::elevate",
"lsass", "SAM", "SYSTEM", "SECURITY",
"ntds.dit", "comsvcs", "MiniDump",
"procdump.*lsass", "Out-Minidump",
"pypykatz", "volatility"
]);
let SuspiciousParents = dynamic([
"cmd.exe", "powershell.exe", "pwsh.exe",
"wscript.exe", "cscript.exe", "mshta.exe",
"rundll32.exe", "regsvr32.exe"
]);
// Branch 1: Known credential dumping tool names
let ToolNameHits = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (CredDumpTools)
or ProcessCommandLine has_any (CredDumpTools)
| extend DetectionBranch = "ToolName"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessParentFileName, DetectionBranch, SHA256;
// Branch 2: Credential dumping arguments in any process
let ArgHits = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (CredDumpArgs)
| extend DetectionBranch = "SuspiciousArgs"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessParentFileName, DetectionBranch, SHA256;
// Branch 3: LSASS memory access via process access events
let LsassAccess = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "ProcessAccess"
| where FileName =~ "lsass.exe"
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "svchost.exe", "csrss.exe",
"wininit.exe", "System", "taskmgr.exe", "services.exe")
| extend DetectionBranch = "LsassAccess"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
FileName=InitiatingProcessFileName,
ProcessCommandLine=InitiatingProcessCommandLine,
InitiatingProcessFileName=InitiatingProcessParentFileName,
InitiatingProcessCommandLine="",
InitiatingProcessParentFileName="", DetectionBranch, SHA256=InitiatingProcessSHA256;
// Branch 4: comsvcs.dll MiniDump via rundll32 targeting LSASS
let ComsvcsMinidump = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has "comsvcs" and ProcessCommandLine has "MiniDump"
| extend DetectionBranch = "ComsvcsMinidump"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessParentFileName, DetectionBranch, SHA256;
// Branch 5: Registry access to credential-bearing hives
let RegistryCredHives = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_any ("HKLM\\SAM", "HKLM\\SECURITY", "HKLM\\SYSTEM")
| where ActionType in ("RegistryKeyExportToFile", "RegistryValueSet")
| where InitiatingProcessFileName !in~ ("regedit.exe", "RegEdit64.exe",
"svchost.exe", "services.exe", "System")
| extend DetectionBranch = "RegistryHiveDump"
| project Timestamp, DeviceName,
AccountName=InitiatingProcessAccountName,
FileName=InitiatingProcessFileName,
ProcessCommandLine=InitiatingProcessCommandLine,
InitiatingProcessFileName=InitiatingProcessParentFileName,
InitiatingProcessCommandLine="",
InitiatingProcessParentFileName="", DetectionBranch, SHA256=InitiatingProcessSHA256;
union ToolNameHits, ArgHits, LsassAccess, ComsvcsMinidump, RegistryCredHives
| summarize Branches=make_set(DetectionBranch), Count=count(),
Commands=make_set(ProcessCommandLine),
Earliest=min(Timestamp), Latest=max(Timestamp)
by DeviceName, AccountName, FileName
| extend RiskScore = array_length(Branches)
| sort by RiskScore desc, Latest descBroad credential dumping detection across five branches: known tool name/binary execution (Mimikatz, ProcDump, LaZagne, etc.), suspicious credential-targeting arguments in any process command line (sekurlsa, lsadump, dcsync), LSASS process memory access from unexpected initiators, comsvcs.dll MiniDump patterns targeting LSASS via rundll32, and unauthorized registry exports of credential-bearing hives (SAM, SECURITY, SYSTEM). Results are grouped by device, account, and filename with a RiskScore indicating how many distinct branches fired — multi-branch matches are highest priority.
Data Sources
Required Tables
False Positives
- Legitimate security tools and EDR agents (CrowdStrike Falcon, Carbon Black, SentinelOne) that access LSASS for memory scanning and threat detection
- Authorized penetration testing or red team exercises using Mimikatz or ProcDump against non-production systems
- IT helpdesk or sysadmin tools that access SAM or SECURITY hives for backup, recovery, or password synchronization tasks
- Microsoft SCCM, Intune, or backup agents that read registry hives during system state backups
- Vulnerability scanning tools (Tenable Nessus, Qualys) that enumerate credential-related registry keys during credentialed scans
Sigma rule & cross-platform mapping
The detection logic for OS Credential Dumping (T1003) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: process_creation
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for T1003
References (9)
- https://attack.mitre.org/techniques/T1003/
- https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
- https://adsecurity.org/?p=1729
- https://github.com/gentilkiwi/mimikatz
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003/T1003.md
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping
- https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
- https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf
- https://www.mandiant.com/resources/blog/detecting-mimikatz-in-your-environment
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Mimikatz sekurlsa::logonpasswords Simulation
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'sekurlsa' and 'logonpasswords'. Security Event ID 4688 (if command line auditing enabled). PowerShell ScriptBlock Log Event ID 4104 with the simulated command content.
- Test 2LSASS Memory Dump via comsvcs.dll MiniDump
Expected signal: Sysmon Event ID 1: Process Create with Image=rundll32.exe, CommandLine containing 'comsvcs.dll' and 'MiniDump'. Security Event ID 4688 with same details. The command will fail for PID 0 but process creation telemetry is generated regardless.
- Test 3Registry Hive Save for Offline SAM Extraction
Expected signal: Sysmon Event ID 1: Three Process Create events with Image=reg.exe and CommandLines matching 'save HKLM\SAM', 'save HKLM\SYSTEM', and 'save HKLM\SECURITY'. Sysmon Event ID 11: File creation events for .hiv files in %TEMP%. Security Event ID 4688 for each reg.exe invocation.
- Test 4Linux /etc/shadow Read Attempt
Expected signal: Linux auditd SYSCALL record with syscall=openat and path=/etc/shadow. Syslog entry showing sudo usage. If auditd is configured with a rule for -w /etc/shadow -p rwa, an AUDIT_WATCH_READ record is generated. /var/log/auth.log will show the sudo invocation.
- Test 5ProcDump LSASS Dump Pattern Simulation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine referencing 'procdump' and 'lsass'. Child process create for cmd.exe spawned by PowerShell. PowerShell ScriptBlock Log Event ID 4104 capturing the simulated command.
Response Playbook
Triage
- Identify which detection branch fired: ToolName (high confidence), SuspiciousArgs (high), LsassAccess (medium — filter EDR agents first), ComsvcsMinidump (high), or RegistryHiveDump (high). Multi-branch matches are almost always true positive.
- Check the initiating process and its parent: was the credential dumper spawned by cmd.exe, PowerShell, mshta.exe, or a document application (winword.exe, excel.exe)? Office spawning credential tools = active intrusion.
- Identify the user context: is this running as SYSTEM, domain admin, or a service account? Credential dumping under SYSTEM or DA context indicates an already-privileged adversary seeking to harvest additional credentials.
- Review the timeline: look back 30 minutes for initial access indicators (phishing execution, exploit shellcode, suspicious PowerShell) and forward for lateral movement (new logon events 4648, PsExec execution, SMB connections to other hosts).
- Check whether the credential dumping tool was downloaded or pre-existing: review Sysmon Event ID 11 (FileCreate) for the tool binary, and check Zone.Identifier ADS to determine if it was downloaded from the internet.
- For LSASS access alerts: verify the initiating process hash against known-good EDR/AV agent hashes in your CMDB. If the SHA256 does not match a known-good security product, treat as malicious.
- Search for any outbound network connections from the dumping process (Sysmon Event ID 3) — if credential data is being exfiltrated in real-time (e.g., to a C2 server), this is a Severity 1 incident requiring immediate containment.
Containment
- Immediately isolate the affected endpoint from the network using EDR isolation or emergency VLAN change to prevent credential use and lateral movement.
- Assume ALL credentials on the compromised host are stolen: initiate emergency password resets for any account that was logged on to the system (check Security Event ID 4624 for the past 30 days).
- If domain admin or service account credentials may have been captured: immediately reset those passwords, revoke all Kerberos tickets with 'klist purge' on impacted systems, and force re-authentication for all domain-joined hosts.
- If DCSync indicators are present: force a domain-wide Kerberos ticket invalidation by resetting the KRBTGT account password TWICE (two resets 10 hours apart to cover ticket lifetime), then reset all privileged account passwords.
- Block the hash or binary path of the identified credential dumping tool in your EDR platform immediately — this prevents re-execution if the adversary regains access.
- Review Active Directory for any new accounts, privilege escalations (Event ID 4728, 4732, 4756), or changes to Kerberos delegation settings that may have occurred since the credential dump.
Evidence Collection
- LSASS process memory — if the host is still live and not yet rebooted, capture a forensic memory image using WinPmem or Magnet RAM Capture; do NOT use the same tool (procdump) that may have been used by the attacker.
- Sysmon Event ID 10 (ProcessAccess) logs — these capture the access rights requested against LSASS; GrantedAccess of 0x1010 or 0x1410 is characteristic of Mimikatz-style LSASS reads.
- Windows Security Event ID 4656 (Handle Request) and 4663 (Object Access) for LSASS — requires audit object access enabled; provides corroborating evidence of memory reads.
- Volume Shadow Copy inventory — run 'vssadmin list shadows' to identify whether VSS copies were accessed or deleted (Sysmon Event ID 1 with vssadmin.exe and 'delete shadows' arguments).
- Registry hive exports — check %TEMP%, %SYSTEMDRIVE%, and any attached network shares for files named SAM, SYSTEM, SECURITY, ntds.dit, or *.dit files created in unusual directories.
- Prefetch files — C:\Windows\Prefetch\MIMIKATZ.EXE-*.pf, PROCDUMP.EXE-*.pf, etc., with execution timestamps even if the tool was deleted afterward.
- MFT (Master File Table) — parse with tools such as MFTECmd to find file creation/access events for credential dumping tool binaries that may have been deleted from the filesystem.
- Windows event log: Microsoft-Windows-Credential-Guard/Operational — shows whether Credential Guard was active and if bypass was attempted.
- For Linux hosts: /var/log/auth.log and /var/log/audit/audit.log for sudo access to /etc/shadow, unexpected cat/cp operations on sensitive files, or unexpected processes reading /proc/*/mem.
Escalation Criteria
- ! Any confirmed Mimikatz or equivalent tool execution — this is an automatic Severity 1 incident regardless of other context.
- ! LSASS access from an unsigned binary or a binary with a non-Microsoft certificate — immediate escalation, likely active credential harvesting.
- ! DCSync indicators (DRSUAPI replication from a non-DC host) — indicates full domain compromise is imminent or has already occurred.
- ! Credential dump followed by rapid lateral movement (new logons to multiple hosts within 15 minutes) — adversary is actively using harvested credentials.
- ! Domain admin, service account, or privileged account credentials confirmed in scope of the dump — treat as full domain compromise.
- ! Evidence that credential data was exfiltrated off the network (outbound connections from the dumping process to external IPs, suspicious DNS queries with high entropy subdomains).
- ! Multiple hosts showing the same credential dumping pattern within a short time window — indicates automated worm-like propagation or coordinated multi-host campaign.
Investigation Guide
Forensic Artifacts
- >
Memory: LSASS process memory dump files (*.dmp) in unusual locations such as %TEMP%, C:\Windows\Temp, C:\PerfLogs, or network shares. - >
Registry: HKLM\SECURITY\Cache — contains cached domain credentials (MSCACHEv2 hashes) for offline domain logon. - >
Registry: HKLM\SAM\SAM\Domains\Account\Users — local account NT/LM hashes (requires SYSTEM privileges to read). - >
Registry: HKLM\SECURITY\Policy\Secrets — LSA secrets including service account passwords and machine account credentials. - >
File System: %WINDIR%\NTDS\ntds.dit on domain controllers — all domain account hashes; check creation/modification dates for unauthorized copies. - >
File System: C:\Windows\Prefetch — prefetch files for known dumping tools (MIMIKATZ.EXE, PROCDUMP.EXE, WCE.EXE, PWDUMP.EXE). - >
Event Log: Security Event ID 4656 with ObjectType=Process and AccessMask containing 0x10 (PROCESS_VM_READ) against LSASS. - >
Event Log: Security Event ID 4663 (Object Access) with lsass.exe as the target — requires SAC auditing enabled. - >
Event Log: Security Event ID 4769 with Ticket Options 0x40810010 and Ticket Encryption Type 0x17 (RC4) for Kerberoasting follow-on. - >
Event Log: Directory Service replication audit (Event ID 4662 with DSReplication access rights) on domain controllers for DCSync detection. - >
Windows Crash Dumps: C:\Windows\Minidump or C:\Windows\memory.dmp if an attacker triggered a crash to capture memory. - >
Linux: /var/log/audit/audit.log SYSCALL records for openat() calls on /etc/shadow with euid=0 from unexpected processes. - >
Linux: /proc/[pid]/mem read access — check auditd rules for OPEN_FOR_READ_AND_WRITE on /proc/*/mem from shell processes.
Tuning Guidance
The primary source of false positives in credential dumping detections is EDR/AV agents that legitimately access LSASS for real-time protection. Build an allowlist of known-good process SHA256 hashes for your deployed security stack (CrowdStrike Falcon Sensor, Carbon Black, SentinelOne, Cylance, etc.) and exclude them from LSASS access alerts — but use hash-based exclusions, never process name exclusions, as attackers will rename tools to evade name-based filters. For registry hive access false positives, whitelist specific backup software process paths (Veeam, Acronis, Windows Server Backup) combined with their expected service account names. DCSync false positives are rare in environments without Azure AD Connect or legitimate DRSUAPI-using products — if you see false positives on Event ID 4662, verify whether AD Connect or a third-party AD synchronization tool is installed. On Linux, tune /etc/shadow access alerts to exclude cron, PAM authentication stack processes, and passwd/chage utilities. Consider creating a tiered alert structure: single-branch low-severity alerts for investigation, multi-branch automatic critical incidents. Suppress tool-name alerts for MITRE ATT&CK simulation platforms (Atomic Red Team, CALDERA) in dedicated test environments by excluding their known service account or machine name patterns.
Hunting Queries
Hunt for all processes accessing LSASS memory that are not known-good security tools. Focuses on the GrantedAccess mask — values containing 0x10 (PROCESS_VM_READ), 0x20 (PROCESS_VM_WRITE), or 0x1010 (common Mimikatz access pattern) are particularly suspicious. This surfaces novel or renamed credential dumping tools that would bypass tool-name signature detection.
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "ProcessAccess"
| where FileName =~ "lsass.exe"
| where InitiatingProcessFileName !in~ (
"MsMpEng.exe", "svchost.exe", "csrss.exe",
"wininit.exe", "services.exe", "System",
"taskmgr.exe", "wmiprvse.exe", "SecurityHealthService.exe",
"SenseCE.exe", "sense.exe", "msseces.exe"
)
| summarize
AccessCount=count(),
Devices=dcount(DeviceName),
GrantedAccessSet=make_set(AdditionalFields),
Earliest=min(Timestamp),
Latest=max(Timestamp)
by InitiatingProcessFileName, InitiatingProcessSHA256, InitiatingProcessAccountName
| sort by AccessCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10 TargetImage="*\\lsass.exe"
NOT (SourceImage="*\\MsMpEng.exe" OR SourceImage="*\\svchost.exe" OR SourceImage="*\\csrss.exe" OR SourceImage="*\\wininit.exe" OR SourceImage="*\\services.exe" OR SourceImage="*\\taskmgr.exe" OR SourceImage="*\\SecurityHealthService.exe")
| stats count as AccessCount, dc(host) as Devices, values(GrantedAccess) as GrantedAccessValues, earliest(_time) as Earliest, latest(_time) as Latest by SourceImage, SourceProcessGUID, User
| sort - AccessCountHunt for registry hive exports targeting credential-bearing hives (SAM, SYSTEM, SECURITY) and ntdsutil.exe execution. Reg.exe save/export of these hives is a common offline credential extraction precursor — the attacker dumps the hives, transfers them to an attacker-controlled machine, and extracts hashes offline with tools like impacket secretsdump. Ntdsutil.exe activation of NTDS snapshot is a classic NTDS.dit extraction technique.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "reg.exe"
| where ProcessCommandLine has_any ("save", "export")
| where ProcessCommandLine has_any ("SAM", "SYSTEM", "SECURITY")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine
| union (
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "ntdsutil.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine
)
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
(Image="*\\reg.exe" (CommandLine="*save*" OR CommandLine="*export*") (CommandLine="*SAM*" OR CommandLine="*SYSTEM*" OR CommandLine="*SECURITY*"))
OR
(Image="*\\ntdsutil.exe")
)
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _timeHunt for DCSync attacks by searching for DS replication extended rights (GUID 1131f6aa = DS-Replication-Get-Changes, 1131f6ab = DS-Replication-Get-Changes-All, 89e95b76 = DS-Replication-Get-Changes-In-Filtered-Set) being exercised by non-machine accounts (accounts not ending in $). This Event ID 4662 approach detects DCSync even when the attack is performed from off-domain or with renamed tools, because it captures the DRSUAPI replication calls at the domain controller itself.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4662
| where ObjectServer == "DS"
| where OperationType == "Object Access"
| where ObjectType has "domainDNS"
| where Properties has "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
or Properties has "1131f6ab-9c07-11d1-f79f-00c04fc2dcd2"
or Properties has "89e95b76-444d-4c62-991a-0facbeda640c"
| where SubjectUserName !has "$"
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName,
ObjectName, Properties, IpAddress
| sort by TimeGenerated descindex=wineventlog sourcetype="WinEventLog:Security" EventCode=4662 ObjectServer="DS" OperationType="Object Access"
(Properties="*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*" OR Properties="*1131f6ab-9c07-11d1-f79f-00c04fc2dcd2*" OR Properties="*89e95b76-444d-4c62-991a-0facbeda640c*")
NOT (SubjectUserName="*$")
| table _time, host, SubjectUserName, SubjectDomainName, ObjectName, Properties, IpAddress
| sort - _timeAtomic Red Team Tests
Simulates the most common credential dumping invocation pattern — Mimikatz privilege escalation followed by logonpassword extraction from LSASS. This test uses a benign PowerShell command that produces the same process creation telemetry as real Mimikatz without extracting actual credentials. Verifies that command line argument detection fires on 'sekurlsa' and 'logonpasswords' patterns.
Command
powershell.exe -Command "Write-Output 'Simulating: .\mimikatz.exe privilege::debug sekurlsa::logonpasswords exit'; Write-Output 'Detection test only - no real credential access'"Expected Telemetry
Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'sekurlsa' and 'logonpasswords'. Security Event ID 4688 (if command line auditing enabled). PowerShell ScriptBlock Log Event ID 4104 with the simulated command content.
Expected Detection
KQL SuspiciousArgs branch fires on 'sekurlsa' match. SPL is_suspicious_args=1, SuspicionScore>=1. Alert should reference AccountName and DeviceName for immediate triage.
Uses the legitimate Windows comsvcs.dll (loaded by Task Manager and other system tools) to create a full memory dump of the LSASS process. This is a LOLBin technique that requires no third-party tools — only rundll32.exe and comsvcs.dll, both present on all Windows systems. Requires SYSTEM or SeDebugPrivilege. This test targets PID 0 (invalid) to simulate the command pattern without actually dumping LSASS.
Command
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump 0 %TEMP%\lsass_sim.dmp fullCleanup
del %TEMP%\lsass_sim.dmp 2>nulExpected Telemetry
Sysmon Event ID 1: Process Create with Image=rundll32.exe, CommandLine containing 'comsvcs.dll' and 'MiniDump'. Security Event ID 4688 with same details. The command will fail for PID 0 but process creation telemetry is generated regardless.
Expected Detection
KQL ComsvcsMinidump branch fires. SPL is_comsvcs_minidump=1, SuspicionScore>=1. High-confidence alert — this specific pattern has very few legitimate uses outside of credential dumping.
Saves the SAM, SYSTEM, and SECURITY registry hives to disk using the built-in reg.exe utility. This is a common precursor to offline credential extraction with tools like impacket secretsdump — the adversary saves the hives, exfiltrates them, then extracts NT hashes locally without touching LSASS. The saved files are removed in cleanup.
Command
reg.exe save HKLM\SAM %TEMP%\sam_test.hiv && reg.exe save HKLM\SYSTEM %TEMP%\system_test.hiv && reg.exe save HKLM\SECURITY %TEMP%\security_test.hivCleanup
del %TEMP%\sam_test.hiv %TEMP%\system_test.hiv %TEMP%\security_test.hiv 2>nulExpected Telemetry
Sysmon Event ID 1: Three Process Create events with Image=reg.exe and CommandLines matching 'save HKLM\SAM', 'save HKLM\SYSTEM', and 'save HKLM\SECURITY'. Sysmon Event ID 11: File creation events for .hiv files in %TEMP%. Security Event ID 4688 for each reg.exe invocation.
Expected Detection
KQL RegistryHiveDump branch fires on RegistryKeyExportToFile events. SPL is_suspicious_args fires on 'SAM' pattern match with reg.exe Image. High confidence — legitimate reg save of SAM/SYSTEM is extremely rare outside of backup tooling.
Simulates adversary access to /etc/shadow on a Linux host to extract password hashes. Requires root privileges. The command attempts to read and display shadow file contents — the actual output depends on file permissions. On systems with proper permissions, this will confirm whether the running user has read access. Detects adversary actions by Ember Bear and similar threat actors targeting Linux credential files.
Command
sudo cat /etc/shadow | head -5Expected Telemetry
Linux auditd SYSCALL record with syscall=openat and path=/etc/shadow. Syslog entry showing sudo usage. If auditd is configured with a rule for -w /etc/shadow -p rwa, an AUDIT_WATCH_READ record is generated. /var/log/auth.log will show the sudo invocation.
Expected Detection
Splunk syslog sourcetype alert on 'cat /etc/shadow' pattern. Auditd rule monitors /etc/shadow for read access (AUDIT_WATCH). SIEM alert should trigger on unexpected process reading shadow file outside of pam_unix/login context.
Simulates the command pattern used by adversaries to dump LSASS memory using ProcDump (a legitimate Sysinternals tool). This test prints the command string to simulate the process telemetry without actually invoking ProcDump — which may not be installed. If ProcDump is available in the test environment, it can be run directly with the command targeting PID 0 or a non-LSASS target to avoid actual credential exposure.
Command
powershell.exe -Command "Write-Output 'Simulating: procdump.exe -accepteula -ma lsass.exe %TEMP%\lsass_procdump.dmp'; Start-Process -FilePath 'cmd.exe' -ArgumentList '/c echo procdump lsass simulation' -Wait"Expected Telemetry
Sysmon Event ID 1: Process Create for powershell.exe with CommandLine referencing 'procdump' and 'lsass'. Child process create for cmd.exe spawned by PowerShell. PowerShell ScriptBlock Log Event ID 4104 capturing the simulated command.
Expected Detection
KQL ToolNameHits branch fires on 'procdump' in ProcessCommandLine. KQL SuspiciousArgs branch fires on 'lsass' pattern. SPL is_tool_name=1 OR is_suspicious_args=1, SuspicionScore>=1. Multi-term match increases confidence.