THREAT-CredentialDump-LSASS IBM QRadar · QRadar

Detect LSASS Credential Dumping via Memory Access in IBM QRadar

LSASS (Local Security Authority Subsystem Service) process memory dumping remains the primary credential theft technique across ransomware operators and APT groups. Attackers access LSASS memory to extract NTLM hashes, Kerberos tickets, and cleartext credentials of all users who have recently authenticated to the system. Common tools: Mimikatz (sekurlsa::logonpasswords, lsadump::sam), ProcDump (procdump -ma lsass.exe), Task Manager dump, comsvcs.dll MiniDump via rundll32, and custom loaders. All documented ransomware groups (Akira, Black Basta, LockBit) use credential dumping to escalate from standard user to domain admin. Detection prioritises the MiniDump-via-rundll32 technique (stealthy, LOL-binary) and ProcDump which are most prevalent. NCSC UK's 2025 ransomware guidance specifically calls out LSASS dumping as a critical detection opportunity in the pre-ransomware kill chain.

MITRE ATT&CK

Tactic
Credential Access

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  logsourcename(logsourceid) AS LogSource,
  "sourceip" AS HostIP,
  "username" AS AccountName,
  "URL" AS ProcessImage,
  "PostNATSourcePort" AS EventCode,
  CASE
    WHEN "URL" ILIKE '%rundll32%' AND ("destinationip" ILIKE '%comsvcs%' OR QIDNAME(qid) ILIKE '%MiniDump%') THEN 'rundll32_comsvcs_MiniDump'
    WHEN "URL" ILIKE '%procdump%' THEN 'ProcDump_LSASS'
    WHEN QIDNAME(qid) ILIKE '%lsass%' AND CATEGORYNAME(category) ILIKE '%process access%' THEN 'LSASS_ProcessAccess'
    WHEN CATEGORYNAME(category) ILIKE '%file create%' AND ("filename" ILIKE '%.dmp' OR "filename" ILIKE '%.mdmp') THEN 'DumpFile_Created'
    ELSE 'Unknown'
  END AS DumpMethod,
  CASE
    WHEN "URL" ILIKE '%rundll32%' AND QIDNAME(qid) ILIKE '%MiniDump%' THEN 95
    WHEN "URL" ILIKE '%procdump%' THEN 90
    WHEN QIDNAME(qid) ILIKE '%lsass%' THEN 85
    ELSE 80
  END AS RiskScore
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 13, 229)
  AND starttime > NOW() - 86400000
  AND (
    (
      QIDNAME(qid) ILIKE '%process create%'
      AND "URL" ILIKE '%rundll32.exe%'
      AND (
        ("commandline" ILIKE '%comsvcs%' AND ("commandline" ILIKE '%MiniDump%' OR "commandline" ILIKE '%#24%'))
        OR ("commandline" ILIKE '%lsass%' AND "commandline" ILIKE '%dump%')
      )
    )
    OR (
      QIDNAME(qid) ILIKE '%process create%'
      AND ("URL" ILIKE '%procdump.exe%' OR "URL" ILIKE '%procdump64.exe%')
      AND ("commandline" ILIKE '%lsass%' OR "commandline" ILIKE '%-ma%')
    )
    OR (
      QIDNAME(qid) ILIKE '%process access%'
      AND "targetprocessname" ILIKE '%lsass.exe%'
      AND "URL" NOT ILIKE '%svchost.exe%'
      AND "URL" NOT ILIKE '%wininit.exe%'
      AND "URL" NOT ILIKE '%lsm.exe%'
      AND "URL" NOT ILIKE '%csrss.exe%'
      AND "URL" NOT ILIKE '%MsMpEng.exe%'
      AND "URL" NOT ILIKE '%SentinelAgent.exe%'
    )
    OR (
      QIDNAME(qid) ILIKE '%file create%'
      AND ("filename" ILIKE '%.dmp' OR "filename" ILIKE '%.mdmp')
      AND ("filepath" ILIKE '%Temp%' OR "filepath" ILIKE '%ProgramData%' OR "filepath" ILIKE '%Users%' OR "filepath" ILIKE '%Public%')
      AND "URL" NOT ILIKE '%werfault.exe%'
      AND "URL" NOT ILIKE '%drwtsn32.exe%'
    )
  )
ORDER BY RiskScore DESC, starttime DESC
critical severity medium confidence

AQL query for IBM QRadar detecting LSASS credential dumping via rundll32/comsvcs MiniDump LOL technique, ProcDump targeting lsass, direct lsass process access from non-whitelisted processes, and suspicious dump file creation. Targets Windows Sysmon and Security log sources (LOGSOURCETYPEID 12=Windows, 13=Sysmon, 229=Microsoft Security).

Data Sources

IBM QRadar SIEMWindows Sysmon (QRadar DSM)Microsoft Windows Security Event Log

Required Tables

events

False Positives & Tuning

  • Legitimate system administration use of ProcDump for capturing crash dumps of lsass.exe during active troubleshooting of authentication issues
  • Security software (EDR agents, AV) that regularly access lsass.exe memory space for protection and monitoring — review SourceImage whitelisting
  • Windows Error Reporting creating .dmp files in temp directories following application or service crashes unrelated to credential access

Other platforms for THREAT-CredentialDump-LSASS

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 LSASS MiniDump via rundll32.exe + comsvcs.dll (LOL Technique)

    Expected signal: Sysmon Event ID 1: rundll32.exe with comsvcs.dll and MiniDump in command line. Sysmon Event ID 11: lsass.dmp created in C:\Windows\Temp\. Windows Security Event ID 4656: handle to lsass.exe requested.

  2. Test 2 LSASS Dump via ProcDump

    Expected signal: Sysmon Event ID 1: procdump.exe with -ma and lsass in command line. Sysmon Event ID 10: procdump64.exe accessing lsass.exe process.

Last updated: 2026-04-25 Research depth: deep
References (3)

Response Playbook

Triage

  1. Identify the process and user account that accessed LSASS. Is this a known security tool (Defender, CrowdStrike, SentinelOne), Windows error reporting, or an unknown process? Unknown process = immediate escalation.
  2. For rundll32 + comsvcs MiniDump: this is an extremely specific LOL technique with almost no legitimate use case. Any detection of this command line targeting lsass.exe should be treated as an active credential dump.
  3. For ProcDump: check if this is a known diagnostic tool invocation by IT staff. Any ProcDump targeting lsass.exe outside of an authorised debug session is high confidence credential theft.
  4. For .dmp file creation in temp directories: identify the dump file path and hash it for threat intelligence lookup. Retrieve the dump file if it still exists for forensic analysis.
  5. Determine what credentials were on the system at the time of the dump: which admin accounts had active sessions? Those accounts should be treated as compromised.

Containment

  1. Isolate the affected host immediately via EDR isolation.
  2. Reset all credentials of accounts that had active sessions on the host at the time of the dump — NTLM hashes for all those accounts are now in attacker hands.
  3. Rotate domain admin passwords and invalidate Kerberos tickets (run klist purge on all domain controllers for the dumped accounts).
  4. Assess whether lateral movement has already occurred using the dumped credentials: check authentication logs for network logons from the affected host to other internal systems.
  5. Enable Protected Users security group membership for privileged accounts — members of Protected Users cannot be included in LSASS memory as cleartext credentials.

Evidence Collection

  1. The dump file itself (if still on disk): contains credential material for forensic analysis
  2. Sysmon Event ID 10: lsass.exe process access with calling process details
  3. Sysmon Event ID 1: command line of ProcDump or rundll32 MiniDump
  4. Windows Security Event ID 4656: handle to lsass.exe object
  5. Memory forensics from the affected host (if acquired before isolation)

Escalation Criteria

  • !rundll32.exe + comsvcs.dll + MiniDump + lsass — immediate incident declaration, no further analysis needed before response
  • !Domain admin or service account credential material was available in LSASS at time of dump
  • !LSASS dump followed by network authentication from compromised credentials to other hosts
  • !Multiple hosts with LSASS dump activity in short time window — indicates pre-ransomware credential harvest

Investigation Guide

Related Techniques

T1003.001 — OS Credential Dumping: LSASS MemoryT1078.002 — Valid Accounts: Domain Accounts (using dumped credentials)T1550.002 — Use Alternate Authentication Material: Pass the HashT1558.003 — Steal or Forge Kerberos Tickets: KerberoastingT1021.002 — Remote Services: SMB/Windows Admin Shares (post-dump lateral movement)

Forensic Artifacts

  • >LSASS dump file (lsass.dmp, lsass.mdmp): contains NTLM hashes, Kerberos tickets
  • >Sysmon Event ID 10: process access events to lsass.exe with PROCESS_VM_READ access right
  • >Windows Security Event ID 4656/4663: handle requests to lsass.exe
  • >Prefetch: PROCDUMP.EXE-*.pf or RUNDLL32.EXE-*.pf with execution timestamps
  • >Memory forensics: extract credentials from LSASS using Volatility for incident evidence

Tuning Guidance

The highest-fidelity signal is rundll32.exe + comsvcs + MiniDump — create a zero-tolerance alert for this specific command pattern with no exceptions. For Sysmon Event ID 10 (process access to lsass), the exclusion list of security products is critical — without it, most EDRs will generate excessive false positives as they legitimately read LSASS memory. Build the exclusion list based on the security products deployed in your environment. For ProcDump, the most important tuning is to only alert when lsass.exe is named as a target — ProcDump has legitimate use for debugging other processes.

Hunting Queries

Hunt for any process accessing LSASS memory (Sysmon Event ID 10 — process access) excluding known security products. Even low-volume access outside the whitelist is suspicious and may indicate custom credential theft tooling that isn't ProcDump or Mimikatz.

Hunting — KQL
kql 
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType =~ "CreateRemoteThreadApiCall"
| where FileName =~ "lsass.exe"
| where InitiatingProcessFileName !in~ (
    "svchost.exe", "wininit.exe", "lsm.exe", "csrss.exe",
    "MsMpEng.exe", "SenseIR.exe", "CSFalconService.exe", "SentinelAgent.exe"
  )
| project Timestamp, DeviceName, AccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
  TargetImage="*lsass.exe"
  NOT (SourceImage IN ("*svchost.exe","*wininit.exe","*lsm.exe","*csrss.exe",
                       "*MsMpEng.exe","*SenseIR.exe","*CSFalconService.exe","*SentinelAgent.exe"))
| stats count BY SourceImage, SourceCommandLine, host
| sort - count

Atomic Red Team Tests

Test 1 LSASS MiniDump via rundll32.exe + comsvcs.dll (LOL Technique)
windows

Dumps LSASS memory using the Windows-native comsvcs.dll MiniDump function via rundll32.exe — the living-off-the-land LSASS dump technique used by Akira, Black Basta, and LockBit to avoid dropping Mimikatz.

Command

powershell 
powershell -Command "$lsassPid = (Get-Process lsass).Id; rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump $lsassPid C:\Windows\Temp\lsass.dmp full"

Cleanup

powershell 
Remove-Item C:\Windows\Temp\lsass.dmp -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: rundll32.exe with comsvcs.dll and MiniDump in command line. Sysmon Event ID 11: lsass.dmp created in C:\Windows\Temp\. Windows Security Event ID 4656: handle to lsass.exe requested.

Expected Detection

Alert fires on rundll32_comsvcs_MiniDump method with RiskScore=95. Immediate escalation required.

Test 2 LSASS Dump via ProcDump
windows

Uses Sysinternals ProcDump to create a full memory dump of the LSASS process. This is equivalent to what attackers do when they have ProcDump available on the system.

Command

powershell 
procdump.exe -accepteula -ma lsass.exe C:\Windows\Temp\lsass_pd.dmp

Cleanup

powershell 
Remove-Item C:\Windows\Temp\lsass_pd.dmp -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: procdump.exe with -ma and lsass in command line. Sysmon Event ID 10: procdump64.exe accessing lsass.exe process.

Expected Detection

Alert fires on ProcDump_LSASS method with RiskScore=90.

Related Detections

Tactic Hub

TA0006 Credential Access

Parent Technique

T1003.001 LSASS Memory

Related Techniques

T1003.001 LSASS Memory T1078.002 Domain Accounts T1550.002 Pass the Hash T1558.003 Kerberoasting T1021.002 SMB/Windows Admin Shares

Same Tactic: Credential Access

Popular Detections