Detect LSASS Memory in Microsoft Sentinel
Adversaries access credential material stored in the LSASS process memory. After logon, Windows stores credentials (NTLM hashes, Kerberos tickets, plaintext passwords via WDigest) in LSASS. Tools used include Mimikatz, ProcDump, comsvcs.dll MiniDump (rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump), WerFault silent process exit, and Cobalt Strike's sekurlsa module. Used extensively by APT1, APT33, OilRig, HAFNIUM, Volt Typhoon, NotPetya, Cobalt Strike operators, and many others. Highest-frequency credential dumping technique observed in the wild.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1003 OS Credential Dumping
- Sub-technique
- T1003.001 LSASS Memory
- Canonical reference
- https://attack.mitre.org/techniques/T1003/001/
KQL Detection Query
let LsassAccessTools = dynamic([
"procdump", "procdump64", "mimikatz", "mimilib", "wce", "gsecdump",
"lsass.exe", "sqldumper", "werfault", "taskmgr"
]);
let SuspiciousLsassAccess = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "ProcessAccessed"
| where FileName =~ "lsass.exe"
| where InitiatingProcessFileName !in~ (
"MsMpEng.exe", "csrss.exe", "services.exe", "lsm.exe",
"svchost.exe", "winlogon.exe", "wmiprvse.exe", "wininit.exe",
"SecurityHealthService.exe", "SenseIR.exe"
)
| where InitiatingProcessGrantedAccessMask in (
"0x1fffff", "0x1f3fff", "0x143a", "0x1410", "0x1010", "0x40"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, InitiatingProcessGrantedAccessMask;
let ComsvcsMinidump = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has_all ("comsvcs.dll", "MiniDump")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine;
let ProcDumpLsass = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("procdump.exe", "procdump64.exe")
| where ProcessCommandLine has "lsass"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine;
union SuspiciousLsassAccess, ComsvcsMinidump, ProcDumpLsass
| sort by Timestamp descDetects LSASS memory access for credential dumping via three detection vectors: (1) suspicious processes opening LSASS with high-privilege access masks via DeviceEvents ProcessAccessed, (2) comsvcs.dll MiniDump via rundll32, and (3) ProcDump targeting lsass. Each vector catches different attacker TTPs for the same objective.
Data Sources
Required Tables
False Positives & Tuning
- EDR agents (CrowdStrike, Carbon Black, Cylance) that legitimately access LSASS for memory scanning — these should be in the process exclusion list
- Windows Error Reporting (WerFault.exe) creating crash dumps when LSASS encounters an error
- IT administrators using Task Manager to create LSASS dump for legitimate debugging purposes
- Sysinternals ProcDump used by operations teams for authorized crash dump collection
Other platforms for T1003.001
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1LSASS Dump via comsvcs.dll MiniDump (LOLBin)
Expected signal: Sysmon Event ID 1: Process Create for rundll32.exe with CommandLine containing comsvcs.dll MiniDump. Sysmon Event ID 10: ProcessAccess for lsass.exe from rundll32.exe with GrantedAccess=0x1fffff. Sysmon Event ID 11: FileCreate for the .dmp file in C:\Windows\Temp\.
- Test 2LSASS Access via PowerShell Reflection (Mimikatz-Style)
Expected signal: Sysmon Event ID 10: ProcessAccess with TargetImage=lsass.exe, SourceImage=powershell.exe. The GrantedAccess value depends on the access requested by Get-Process. Security Event ID 4656/4663 if process object auditing is enabled.
- Test 3LSASS Dump via ProcDump
Expected signal: Sysmon Event ID 10: ProcessAccess with TargetImage=lsass.exe, SourceImage=procdump.exe, GrantedAccess=0x1fffff. Sysmon Event ID 11: FileCreate for lsass_pd_test.dmp. Sysmon Event ID 1: Process Create for procdump.exe with lsass.exe in CommandLine.
References (7)
- https://attack.mitre.org/techniques/T1003/001/
- https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
- https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md
- https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard
- https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
Unlock Pro Content
Get the full detection package for T1003.001 including response playbook, investigation guide, and atomic red team tests.