Which SIEM platforms have a THREAT-CredentialDump-LSASS detection rule?

df00tech provides THREAT-CredentialDump-LSASS (LSASS Credential Dumping via Memory Access) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-CredentialDump-LSASS detection?

The THREAT-CredentialDump-LSASS detection is rated critical severity with high confidence.

What are common false positives for THREAT-CredentialDump-LSASS?

Common false positives for THREAT-CredentialDump-LSASS include: Windows Error Reporting (WER/werfault.exe) creating process dumps for crashed applications; Security products (CrowdStrike, SentinelOne, Defender) accessing LSASS for legitimate monitoring; Authorised penetration testers using Mimikatz or ProcDump during red team exercises.

THREAT-CredentialDump-LSASS Elastic Security · Elastic

Detect LSASS Credential Dumping via Memory Access in Elastic Security

Q: What data sources are required to detect LSASS Credential Dumping via Memory Access (THREAT-CredentialDump-LSASS)?

Detecting LSASS Credential Dumping via Memory Access requires the following data sources: Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceEvents, DeviceFileEvents), Sysmon Event ID 1, 10, 11, Windows Security Event Log (Event ID 4656, 10).

LSASS (Local Security Authority Subsystem Service) process memory dumping remains the primary credential theft technique across ransomware operators and APT groups. Attackers access LSASS memory to extract NTLM hashes, Kerberos tickets, and cleartext credentials of all users who have recently authenticated to the system. Common tools: Mimikatz (sekurlsa::logonpasswords, lsadump::sam), ProcDump (procdump -ma lsass.exe), Task Manager dump, comsvcs.dll MiniDump via rundll32, and custom loaders. All documented ransomware groups (Akira, Black Basta, LockBit) use credential dumping to escalate from standard user to domain admin. Detection prioritises the MiniDump-via-rundll32 technique (stealthy, LOL-binary) and ProcDump which are most prevalent. NCSC UK's 2025 ransomware guidance specifically calls out LSASS dumping as a critical detection opportunity in the pre-ransomware kill chain.

MITRE ATT&CK

Tactic: Credential Access

Elastic Detection Query

Elastic Security (Elastic)

eql

sequence by host.name with maxspan=5m
[
  any where (
    (
      event.category == "process" and event.type == "start" and
      process.name : "rundll32.exe" and
      (
        (process.args : "comsvcs*" and (process.args : "*MiniDump*" or process.args : "*#24*")) or
        (process.command_line : "*comsvcs*" and process.command_line : "*MiniDump*") or
        (process.command_line : "*lsass*" and process.command_line : "*dump*")
      )
    ) or
    (
      event.category == "process" and event.type == "start" and
      process.name : ("procdump.exe", "procdump64.exe") and
      (process.command_line : "*lsass*" or process.args : "-ma")
    ) or
    (
      event.category == "process" and event.type == "access" and
      process.name : "lsass.exe" and
      not process.parent.name : ("svchost.exe", "wininit.exe", "lsm.exe", "csrss.exe", "SecurityHealthService.exe", "MsMpEng.exe", "SenseIR.exe", "MsSense.exe")
    ) or
    (
      event.category == "file" and event.type == "creation" and
      (file.extension : "dmp" or file.extension : "mdmp") and
      file.path : ("*\\Temp\\*", "*\\tmp\\*", "*\\ProgramData\\*", "*\\Users\\*", "*\\Public\\*") and
      not process.name : ("werfault.exe", "WerFaultSecure.exe", "drwtsn32.exe", "msdtc.exe")
    )
  )
]

critical severity high confidence

Detects LSASS credential dumping via four methods: (1) rundll32.exe with comsvcs.dll MiniDump LOL technique, (2) ProcDump targeting lsass.exe, (3) direct process access to lsass from non-whitelisted processes, (4) suspicious .dmp/.mdmp file creation in writable user-accessible locations. Covers Akira, Black Basta, LockBit, and Scattered Spider TTPs.

Data Sources

Elastic Endpoint SecurityWindows Event Logs via Elastic AgentSysmon via Elastic Agent

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.file-*logs-windows.sysmon_operational-*

False Positives & Tuning

Legitimate memory diagnostic tools used by IT operations running ProcDump against system processes for debugging purposes
Crash dump collection by Windows Error Reporting (WER) creating .dmp files in temp locations during application failures
EDR and AV solutions that legitimately access lsass.exe memory for process protection and credential guard monitoring

Download portable Sigma rule (.yml)

Other platforms for THREAT-CredentialDump-LSASS

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1LSASS MiniDump via rundll32.exe + comsvcs.dll (LOL Technique)
Expected signal: Sysmon Event ID 1: rundll32.exe with comsvcs.dll and MiniDump in command line. Sysmon Event ID 11: lsass.dmp created in C:\Windows\Temp\. Windows Security Event ID 4656: handle to lsass.exe requested.
Test 2LSASS Dump via ProcDump
Expected signal: Sysmon Event ID 1: procdump.exe with -ma and lsass in command line. Sysmon Event ID 10: procdump64.exe accessing lsass.exe process.

Last updated: 2026-04-25 Research depth: deep

References (5)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for THREAT-CredentialDump-LSASS including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Parent Technique

T1003.001LSASS Memory

Related Techniques

T1003.001LSASS Memory T1078.002Domain Accounts T1550.002Pass the Hash T1558.003Kerberoasting T1021.002SMB/Windows Admin Shares

Detect LSASS Credential Dumping via Memory Access in Elastic Security

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for THREAT-CredentialDump-LSASS

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Techniques

Same Tactic: Credential Access

Popular Detections

MITRE ATT&CK

Elastic Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for THREAT-CredentialDump-LSASS

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Techniques

Same Tactic: Credential Access

Popular Detections

Get new detections in your inbox