Detect LSASS Credential Dumping via Memory Access in CrowdStrike LogScale
LSASS (Local Security Authority Subsystem Service) process memory dumping remains the primary credential theft technique across ransomware operators and APT groups. Attackers access LSASS memory to extract NTLM hashes, Kerberos tickets, and cleartext credentials of all users who have recently authenticated to the system. Common tools: Mimikatz (sekurlsa::logonpasswords, lsadump::sam), ProcDump (procdump -ma lsass.exe), Task Manager dump, comsvcs.dll MiniDump via rundll32, and custom loaders. All documented ransomware groups (Akira, Black Basta, LockBit) use credential dumping to escalate from standard user to domain admin. Detection prioritises the MiniDump-via-rundll32 technique (stealthy, LOL-binary) and ProcDump which are most prevalent. NCSC UK's 2025 ransomware guidance specifically calls out LSASS dumping as a critical detection opportunity in the pre-ransomware kill chain.
MITRE ATT&CK
- Tactic
- Credential Access
LogScale Detection Query
// LSASS Credential Dumping Detection — CrowdStrike LogScale (Falcon)
// Method 1: rundll32 + comsvcs MiniDump
#event_simpleName=ProcessRollup2
| ImageFileName = /rundll32\.exe/i
| CommandLine = /comsvcs/i
| CommandLine = /(MiniDump|#24|lsass.*dump)/i
| DumpMethod := "rundll32_comsvcs_MiniDump"
| RiskScore := 95
// Union with Method 2: ProcDump
| union [
#event_simpleName=ProcessRollup2
| ImageFileName = /(procdump|procdump64)\.exe/i
| CommandLine = /(lsass|-ma)/i
| DumpMethod := "ProcDump_LSASS"
| RiskScore := 90
]
// Union with Method 3: Process injection/access targeting lsass
| union [
#event_simpleName=ProcessRollup2
| TargetProcessId != null
| TargetImageFileName = /lsass\.exe/i
| ImageFileName != /(svchost|wininit|lsm|csrss|SecurityHealthService|MsMpEng|SenseIR|MsSense|SentinelAgent|CSFalconService)\.exe/i
| DumpMethod := "LSASS_ProcessAccess"
| RiskScore := 85
]
// Union with Method 4: .dmp/.mdmp file creation in suspicious paths
| union [
#event_simpleName=PeFileWritten OR #event_simpleName=SuspiciousFileWrite
| TargetFileName = /\.(dmp|mdmp)$/i
| TargetFileName = /(Temp|tmp|ProgramData|Users|Public)/i
| TargetFileName != /(WER|Crash)/i
| ImageFileName != /(werfault|WerFaultSecure|drwtsn32|msdtc)\.exe/i
| DumpMethod := "DumpFile_Created"
| RiskScore := 80
]
| groupBy([ComputerName, UserName, DumpMethod, RiskScore], function=[
count(as=EventCount),
collect([ImageFileName, CommandLine], multival=true, limit=10)
])
| ThreatActors := "Akira, Black Basta, LockBit, Scattered Spider"
| sort(RiskScore, order=desc)CrowdStrike LogScale (Falcon) query detecting LSASS credential dumping using Falcon process telemetry. Covers four methods: rundll32/comsvcs MiniDump LOL technique, ProcDump targeting lsass, direct LSASS process access from non-whitelisted parent processes, and suspicious dump file creation. Uses native Falcon event types ProcessRollup2 and file write events for comprehensive coverage.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor itself (CSFalconService.exe) accessing lsass.exe — already excluded but verify CSFalconService is in the exclusion regex for your environment
- Legitimate sysadmin use of ProcDump or Task Manager dump feature during authorized incident response or debugging sessions on servers experiencing authentication failures
- Third-party PAM (Privileged Access Management) solutions that periodically access LSASS to rotate credentials or validate password policy compliance
Other platforms for THREAT-CredentialDump-LSASS
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1LSASS MiniDump via rundll32.exe + comsvcs.dll (LOL Technique)
Expected signal: Sysmon Event ID 1: rundll32.exe with comsvcs.dll and MiniDump in command line. Sysmon Event ID 11: lsass.dmp created in C:\Windows\Temp\. Windows Security Event ID 4656: handle to lsass.exe requested.
- Test 2LSASS Dump via ProcDump
Expected signal: Sysmon Event ID 1: procdump.exe with -ma and lsass in command line. Sysmon Event ID 10: procdump64.exe accessing lsass.exe process.
References (5)
- https://www.ncsc.gov.uk/collection/ransomware/credential-access
- https://attack.mitre.org/techniques/T1003/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md
- https://lolbas-project.github.io/lolbas/Libraries/Comsvcs/
- https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group
Unlock Pro Content
Get the full detection package for THREAT-CredentialDump-LSASS including response playbook, investigation guide, and atomic red team tests.