Detect OS Credential Dumping in Microsoft Sentinel
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures. This parent technique encompasses multiple sub-techniques targeting LSASS memory, SAM database, NTDS, LSA Secrets, cached domain credentials, DCSync, the Linux /proc filesystem, and /etc/passwd and /etc/shadow files. Credential material is subsequently used for lateral movement, privilege escalation, and persistent access. Widely used by APT groups including APT32, APT39, Ember Bear, BlackByte, Tonto Team, and Mustang Panda, as well as malware families such as Mimikatz, Carbanak, MgBot, and Revenge RAT.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1003 OS Credential Dumping
- Canonical reference
- https://attack.mitre.org/techniques/T1003/
KQL Detection Query
let CredDumpTools = dynamic([
"mimikatz", "mimilib", "mimidrv",
"procdump", "procdump64",
"wce.exe", "pwdump", "fgdump",
"gsecdump", "cachedump", "lsadump",
"secretsdump", "impacket",
"crackmapexec", "safetydump",
"sharpdump", "sharpkatz",
"laZagne", "lazagne",
"nanodump", "handlekatz"
]);
let CredDumpArgs = dynamic([
"sekurlsa", "lsadump", "dcsync",
"logonpasswords", "wdigest", "kerberos",
"privilege::debug", "token::elevate",
"lsass", "SAM", "SYSTEM", "SECURITY",
"ntds.dit", "comsvcs", "MiniDump",
"procdump.*lsass", "Out-Minidump",
"pypykatz", "volatility"
]);
let SuspiciousParents = dynamic([
"cmd.exe", "powershell.exe", "pwsh.exe",
"wscript.exe", "cscript.exe", "mshta.exe",
"rundll32.exe", "regsvr32.exe"
]);
// Branch 1: Known credential dumping tool names
let ToolNameHits = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (CredDumpTools)
or ProcessCommandLine has_any (CredDumpTools)
| extend DetectionBranch = "ToolName"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessParentFileName, DetectionBranch, SHA256;
// Branch 2: Credential dumping arguments in any process
let ArgHits = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (CredDumpArgs)
| extend DetectionBranch = "SuspiciousArgs"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessParentFileName, DetectionBranch, SHA256;
// Branch 3: LSASS memory access via process access events
let LsassAccess = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "ProcessAccess"
| where FileName =~ "lsass.exe"
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "svchost.exe", "csrss.exe",
"wininit.exe", "System", "taskmgr.exe", "services.exe")
| extend DetectionBranch = "LsassAccess"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
FileName=InitiatingProcessFileName,
ProcessCommandLine=InitiatingProcessCommandLine,
InitiatingProcessFileName=InitiatingProcessParentFileName,
InitiatingProcessCommandLine="",
InitiatingProcessParentFileName="", DetectionBranch, SHA256=InitiatingProcessSHA256;
// Branch 4: comsvcs.dll MiniDump via rundll32 targeting LSASS
let ComsvcsMinidump = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has "comsvcs" and ProcessCommandLine has "MiniDump"
| extend DetectionBranch = "ComsvcsMinidump"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessParentFileName, DetectionBranch, SHA256;
// Branch 5: Registry access to credential-bearing hives
let RegistryCredHives = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_any ("HKLM\\SAM", "HKLM\\SECURITY", "HKLM\\SYSTEM")
| where ActionType in ("RegistryKeyExportToFile", "RegistryValueSet")
| where InitiatingProcessFileName !in~ ("regedit.exe", "RegEdit64.exe",
"svchost.exe", "services.exe", "System")
| extend DetectionBranch = "RegistryHiveDump"
| project Timestamp, DeviceName,
AccountName=InitiatingProcessAccountName,
FileName=InitiatingProcessFileName,
ProcessCommandLine=InitiatingProcessCommandLine,
InitiatingProcessFileName=InitiatingProcessParentFileName,
InitiatingProcessCommandLine="",
InitiatingProcessParentFileName="", DetectionBranch, SHA256=InitiatingProcessSHA256;
union ToolNameHits, ArgHits, LsassAccess, ComsvcsMinidump, RegistryCredHives
| summarize Branches=make_set(DetectionBranch), Count=count(),
Commands=make_set(ProcessCommandLine),
Earliest=min(Timestamp), Latest=max(Timestamp)
by DeviceName, AccountName, FileName
| extend RiskScore = array_length(Branches)
| sort by RiskScore desc, Latest descBroad credential dumping detection across five branches: known tool name/binary execution (Mimikatz, ProcDump, LaZagne, etc.), suspicious credential-targeting arguments in any process command line (sekurlsa, lsadump, dcsync), LSASS process memory access from unexpected initiators, comsvcs.dll MiniDump patterns targeting LSASS via rundll32, and unauthorized registry exports of credential-bearing hives (SAM, SECURITY, SYSTEM). Results are grouped by device, account, and filename with a RiskScore indicating how many distinct branches fired — multi-branch matches are highest priority.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate security tools and EDR agents (CrowdStrike Falcon, Carbon Black, SentinelOne) that access LSASS for memory scanning and threat detection
- Authorized penetration testing or red team exercises using Mimikatz or ProcDump against non-production systems
- IT helpdesk or sysadmin tools that access SAM or SECURITY hives for backup, recovery, or password synchronization tasks
- Microsoft SCCM, Intune, or backup agents that read registry hives during system state backups
- Vulnerability scanning tools (Tenable Nessus, Qualys) that enumerate credential-related registry keys during credentialed scans
Other platforms for T1003
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Mimikatz sekurlsa::logonpasswords Simulation
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'sekurlsa' and 'logonpasswords'. Security Event ID 4688 (if command line auditing enabled). PowerShell ScriptBlock Log Event ID 4104 with the simulated command content.
- Test 2LSASS Memory Dump via comsvcs.dll MiniDump
Expected signal: Sysmon Event ID 1: Process Create with Image=rundll32.exe, CommandLine containing 'comsvcs.dll' and 'MiniDump'. Security Event ID 4688 with same details. The command will fail for PID 0 but process creation telemetry is generated regardless.
- Test 3Registry Hive Save for Offline SAM Extraction
Expected signal: Sysmon Event ID 1: Three Process Create events with Image=reg.exe and CommandLines matching 'save HKLM\SAM', 'save HKLM\SYSTEM', and 'save HKLM\SECURITY'. Sysmon Event ID 11: File creation events for .hiv files in %TEMP%. Security Event ID 4688 for each reg.exe invocation.
- Test 4Linux /etc/shadow Read Attempt
Expected signal: Linux auditd SYSCALL record with syscall=openat and path=/etc/shadow. Syslog entry showing sudo usage. If auditd is configured with a rule for -w /etc/shadow -p rwa, an AUDIT_WATCH_READ record is generated. /var/log/auth.log will show the sudo invocation.
- Test 5ProcDump LSASS Dump Pattern Simulation
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine referencing 'procdump' and 'lsass'. Child process create for cmd.exe spawned by PowerShell. PowerShell ScriptBlock Log Event ID 4104 capturing the simulated command.
References (12)
- https://attack.mitre.org/techniques/T1003/
- https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
- https://adsecurity.org/?p=1729
- https://github.com/gentilkiwi/mimikatz
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003/T1003.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/credential_access
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping
- https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
- https://labs.portcullis.co.uk/download/eu-18-Wadhwa-Brown-Where-2-worlds-collide-Bringing-Mimikatz-et-al-to-UNIX.pdf
- https://www.mandiant.com/resources/blog/detecting-mimikatz-in-your-environment
- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/mimikatz.htm
- https://www.cybereason.com/blog/the-anatomy-of-mimikatz
Unlock Pro Content
Get the full detection package for T1003 including response playbook, investigation guide, and atomic red team tests.