Detect LSASS Credential Dumping via Memory Access in Google Chronicle
LSASS (Local Security Authority Subsystem Service) process memory dumping remains the primary credential theft technique across ransomware operators and APT groups. Attackers access LSASS memory to extract NTLM hashes, Kerberos tickets, and cleartext credentials of all users who have recently authenticated to the system. Common tools: Mimikatz (sekurlsa::logonpasswords, lsadump::sam), ProcDump (procdump -ma lsass.exe), Task Manager dump, comsvcs.dll MiniDump via rundll32, and custom loaders. All documented ransomware groups (Akira, Black Basta, LockBit) use credential dumping to escalate from standard user to domain admin. Detection prioritises the MiniDump-via-rundll32 technique (stealthy, LOL-binary) and ProcDump which are most prevalent. NCSC UK's 2025 ransomware guidance specifically calls out LSASS dumping as a critical detection opportunity in the pre-ransomware kill chain.
MITRE ATT&CK
- Tactic
- Credential Access
YARA-L Detection Query
rule lsass_credential_dumping_multi_method {
meta:
author = "df00tech Detection Engineering"
description = "Detects LSASS credential dumping via rundll32/comsvcs MiniDump, ProcDump, direct process access, and dump file creation"
severity = "CRITICAL"
priority = "HIGH"
mitre_attack_tactic = "Credential Access"
mitre_attack_technique = "T1003.001"
reference = "https://attack.mitre.org/techniques/T1003/001/"
threat_actors = "Akira, Black Basta, LockBit, Scattered Spider"
events:
(
// Method 1: rundll32 + comsvcs MiniDump (LOL technique)
(
$e1.metadata.event_type = "PROCESS_LAUNCH"
and re.regex($e1.principal.process.file.full_path, `(?i)rundll32\.exe`)
and (
(
re.regex($e1.target.process.command_line, `(?i)comsvcs`) and
re.regex($e1.target.process.command_line, `(?i)(MiniDump|#24)`)
) or
(
re.regex($e1.target.process.command_line, `(?i)lsass`) and
re.regex($e1.target.process.command_line, `(?i)dump`)
)
)
)
or
// Method 2: ProcDump targeting lsass
(
$e1.metadata.event_type = "PROCESS_LAUNCH"
and re.regex($e1.target.process.file.full_path, `(?i)procdump(64)?\.exe`)
and (
re.regex($e1.target.process.command_line, `(?i)lsass`) or
re.regex($e1.target.process.command_line, `(?i)-ma`)
)
)
or
// Method 3: Process access to lsass from suspicious source
(
$e1.metadata.event_type = "PROCESS_OPEN"
and re.regex($e1.target.process.file.full_path, `(?i)lsass\.exe`)
and not re.regex($e1.principal.process.file.full_path, `(?i)(svchost|wininit|lsm|csrss|SecurityHealthService|MsMpEng|SenseIR|MsSense|SentinelAgent|CSFalconService)\.exe`)
)
or
// Method 4: Suspicious .dmp/.mdmp file creation
(
$e1.metadata.event_type = "FILE_CREATION"
and re.regex($e1.target.file.full_path, `(?i)\.(dmp|mdmp)$`)
and re.regex($e1.target.file.full_path, `(?i)(Temp|tmp|ProgramData|Users|Public)`)
and not re.regex($e1.target.file.full_path, `(?i)(WER|Crash)`)
and not re.regex($e1.principal.process.file.full_path, `(?i)(werfault|WerFaultSecure|drwtsn32|msdtc)\.exe`)
)
)
condition:
$e1
}Chronicle YARA-L 2.0 rule detecting LSASS credential dumping across four methods using UDM event model. Covers the rundll32/comsvcs LOL technique (highest severity), ProcDump usage, direct process access to lsass.exe from non-whitelisted processes, and suspicious memory dump file creation in user-accessible directories.
Data Sources
Required Tables
False Positives & Tuning
- Authorized red team or penetration testing exercises using standard credential dumping tools as part of a scoped engagement — coordinate with security team for time-based exclusions
- Vendor-supplied diagnostic utilities that create process memory dumps of lsass.exe for authentication troubleshooting on domain controllers
- Windows kernel and system dump operations triggered by BSOD or kernel crash events generating .dmp files in accessible paths before WER moves them
Other platforms for THREAT-CredentialDump-LSASS
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1LSASS MiniDump via rundll32.exe + comsvcs.dll (LOL Technique)
Expected signal: Sysmon Event ID 1: rundll32.exe with comsvcs.dll and MiniDump in command line. Sysmon Event ID 11: lsass.dmp created in C:\Windows\Temp\. Windows Security Event ID 4656: handle to lsass.exe requested.
- Test 2LSASS Dump via ProcDump
Expected signal: Sysmon Event ID 1: procdump.exe with -ma and lsass in command line. Sysmon Event ID 10: procdump64.exe accessing lsass.exe process.
References (5)
- https://www.ncsc.gov.uk/collection/ransomware/credential-access
- https://attack.mitre.org/techniques/T1003/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md
- https://lolbas-project.github.io/lolbas/Libraries/Comsvcs/
- https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group
Unlock Pro Content
Get the full detection package for THREAT-CredentialDump-LSASS including response playbook, investigation guide, and atomic red team tests.