Detect LSASS Credential Dumping via Memory Access in Splunk
LSASS (Local Security Authority Subsystem Service) process memory dumping remains the primary credential theft technique across ransomware operators and APT groups. Attackers access LSASS memory to extract NTLM hashes, Kerberos tickets, and cleartext credentials of all users who have recently authenticated to the system. Common tools: Mimikatz (sekurlsa::logonpasswords, lsadump::sam), ProcDump (procdump -ma lsass.exe), Task Manager dump, comsvcs.dll MiniDump via rundll32, and custom loaders. All documented ransomware groups (Akira, Black Basta, LockBit) use credential dumping to escalate from standard user to domain admin. Detection prioritises the MiniDump-via-rundll32 technique (stealthy, LOL-binary) and ProcDump which are most prevalent. NCSC UK's 2025 ransomware guidance specifically calls out LSASS dumping as a critical detection opportunity in the pre-ransomware kill chain.
MITRE ATT&CK
- Tactic
- Credential Access
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(
(
EventCode=1
Image="*\\rundll32.exe"
(CommandLine="*comsvcs*" AND (CommandLine="*MiniDump*" OR CommandLine="*#24*" OR CommandLine="*lsass*"))
)
OR
(
EventCode=1
(Image="*\\procdump.exe" OR Image="*\\procdump64.exe")
(CommandLine="*lsass*" OR CommandLine="*-ma*")
)
OR
(
EventCode=10
TargetImage="*\\lsass.exe"
NOT (SourceImage="*\\svchost.exe" OR SourceImage="*\\wininit.exe" OR
SourceImage="*\\lsm.exe" OR SourceImage="*\\csrss.exe" OR
SourceImage="*\\SecurityHealthService.exe" OR SourceImage="*\\MsMpEng.exe" OR
SourceImage="*\\SenseIR.exe" OR SourceImage="*\\MsSense.exe" OR
SourceImage="*\\CSFalconService.exe" OR SourceImage="*\\SentinelAgent.exe")
)
OR
(
EventCode=11
(TargetFilename="*.dmp" OR TargetFilename="*.mdmp")
NOT (Image="*\\werfault.exe" OR Image="*\\WerFaultSecure.exe" OR Image="*\\drwtsn32.exe")
(TargetFilename="*Temp*" OR TargetFilename="*ProgramData*" OR TargetFilename="*Users*" OR TargetFilename="*Public*")
)
)
| eval DumpMethod=case(
EventCode=1 AND match(Image, "(?i)rundll32") AND match(CommandLine, "(?i)(comsvcs|MiniDump|#24)"),
"rundll32_comsvcs_MiniDump",
EventCode=1 AND match(Image, "(?i)procdump"),
"ProcDump_LSASS",
EventCode=10 AND match(TargetImage, "(?i)lsass"),
"LSASS_ProcessAccess",
EventCode=11 AND (match(TargetFilename, "(?i)\.dmp") OR match(TargetFilename, "(?i)\.mdmp")),
"DumpFile_Created",
true(), "Other"
)
| eval RiskScore=case(
DumpMethod="rundll32_comsvcs_MiniDump", 95,
DumpMethod="ProcDump_LSASS", 90,
DumpMethod="LSASS_ProcessAccess", 85,
DumpMethod="DumpFile_Created", 80,
true(), 50
)
| stats count AS Events, values(DumpMethod) AS Methods, max(RiskScore) AS MaxRisk
BY host, User, _time span=30m
| eval ThreatActors="Akira, Black Basta, LockBit, Scattered Spider"
| sort - MaxRiskSPL LSASS credential dump detection via Sysmon. Covers four Sysmon event types: Event ID 1 (process creation for rundll32 MiniDump and ProcDump), Event ID 10 (process access to lsass.exe), and Event ID 11 (dump file creation). Excludes known-good security tool accesses (Defender, CrowdStrike, SentinelOne) to reduce false positives.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Windows Error Reporting creating crash dumps
- Security products (MsMpEng, CSFalconService, SentinelAgent) accessing LSASS
- Authorised red team activity during scheduled exercises
Other platforms for THREAT-CredentialDump-LSASS
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1LSASS MiniDump via rundll32.exe + comsvcs.dll (LOL Technique)
Expected signal: Sysmon Event ID 1: rundll32.exe with comsvcs.dll and MiniDump in command line. Sysmon Event ID 11: lsass.dmp created in C:\Windows\Temp\. Windows Security Event ID 4656: handle to lsass.exe requested.
- Test 2LSASS Dump via ProcDump
Expected signal: Sysmon Event ID 1: procdump.exe with -ma and lsass in command line. Sysmon Event ID 10: procdump64.exe accessing lsass.exe process.
References (5)
- https://www.ncsc.gov.uk/collection/ransomware/credential-access
- https://attack.mitre.org/techniques/T1003/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md
- https://lolbas-project.github.io/lolbas/Libraries/Comsvcs/
- https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group
Unlock Pro Content
Get the full detection package for THREAT-CredentialDump-LSASS including response playbook, investigation guide, and atomic red team tests.