Detect LSASS Credential Dumping via Memory Access in Sumo Logic CSE
LSASS (Local Security Authority Subsystem Service) process memory dumping remains the primary credential theft technique across ransomware operators and APT groups. Attackers access LSASS memory to extract NTLM hashes, Kerberos tickets, and cleartext credentials of all users who have recently authenticated to the system. Common tools: Mimikatz (sekurlsa::logonpasswords, lsadump::sam), ProcDump (procdump -ma lsass.exe), Task Manager dump, comsvcs.dll MiniDump via rundll32, and custom loaders. All documented ransomware groups (Akira, Black Basta, LockBit) use credential dumping to escalate from standard user to domain admin. Detection prioritises the MiniDump-via-rundll32 technique (stealthy, LOL-binary) and ProcDump which are most prevalent. NCSC UK's 2025 ransomware guidance specifically calls out LSASS dumping as a critical detection opportunity in the pre-ransomware kill chain.
MITRE ATT&CK
- Tactic
- Credential Access
Sumo Detection Query
_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*endpoint*
| where _sourceName matches "*Sysmon*" or _sourceName matches "*Security*" or _sourceName matches "*WinEventLog*"
| parse "<EventID>*</EventID>" as EventCode nodrop
| parse "<Image>*</Image>" as ProcessImage nodrop
| parse "<CommandLine>*</CommandLine>" as CommandLine nodrop
| parse "<TargetImage>*</TargetImage>" as TargetImage nodrop
| parse "<TargetFilename>*</TargetFilename>" as TargetFilename nodrop
| parse "<User>*</User>" as AccountUser nodrop
| parse "<Computer>*</Computer>" as HostName nodrop
| parse "<SourceImage>*</SourceImage>" as SourceImage nodrop
| where (
(
EventCode = "1"
and ProcessImage matches "*rundll32.exe*"
and (
(CommandLine matches "*comsvcs*" and (CommandLine matches "*MiniDump*" or CommandLine matches "*#24*"))
or (CommandLine matches "*lsass*" and CommandLine matches "*dump*")
)
)
or (
EventCode = "1"
and (ProcessImage matches "*procdump.exe*" or ProcessImage matches "*procdump64.exe*")
and (CommandLine matches "*lsass*" or CommandLine matches "*-ma*")
)
or (
EventCode = "10"
and TargetImage matches "*lsass.exe*"
and not (SourceImage matches "*svchost.exe*" or SourceImage matches "*wininit.exe*"
or SourceImage matches "*lsm.exe*" or SourceImage matches "*csrss.exe*"
or SourceImage matches "*SecurityHealthService.exe*" or SourceImage matches "*MsMpEng.exe*"
or SourceImage matches "*SenseIR.exe*" or SourceImage matches "*MsSense.exe*"
or SourceImage matches "*SentinelAgent.exe*" or SourceImage matches "*CSFalconService.exe*")
)
or (
EventCode = "11"
and (TargetFilename matches "*.dmp" or TargetFilename matches "*.mdmp")
and (TargetFilename matches "*Temp*" or TargetFilename matches "*ProgramData*"
or TargetFilename matches "*Users*" or TargetFilename matches "*Public*")
and not (ProcessImage matches "*werfault.exe*" or ProcessImage matches "*WerFaultSecure.exe*"
or ProcessImage matches "*drwtsn32.exe*")
)
)
| if (EventCode = "1" and ProcessImage matches "*rundll32*" and CommandLine matches "*comsvcs*",
"rundll32_comsvcs_MiniDump",
if (EventCode = "1" and (ProcessImage matches "*procdump*"),
"ProcDump_LSASS",
if (EventCode = "10" and TargetImage matches "*lsass*",
"LSASS_ProcessAccess",
if (EventCode = "11" and (TargetFilename matches "*.dmp" or TargetFilename matches "*.mdmp"),
"DumpFile_Created", "Other")))) as DumpMethod
| if (DumpMethod = "rundll32_comsvcs_MiniDump", 95,
if (DumpMethod = "ProcDump_LSASS", 90,
if (DumpMethod = "LSASS_ProcessAccess", 85, 80))) as RiskScore
| count as Events by HostName, AccountUser, DumpMethod, RiskScore
| sort by RiskScore descSumo Logic query detecting LSASS memory dumping across four vectors: rundll32/comsvcs MiniDump LOL technique (RiskScore 95), ProcDump targeting lsass (90), unauthorized lsass process access via Sysmon Event 10 (85), and suspicious .dmp/.mdmp file creation (80). Parses Sysmon XML events from Windows endpoint log sources.
Data Sources
Required Tables
False Positives & Tuning
- Security operations teams running ProcDump as part of authorized forensic investigations or incident response on compromised hosts
- Enterprise monitoring agents (CrowdStrike Falcon, SentinelOne, Microsoft Defender) performing routine lsass inspection — extend SourceImage exclusions as needed
- Application crash dump collection by Windows Error Reporting generating .dmp files in %TEMP% or AppData during legitimate application failures
Other platforms for THREAT-CredentialDump-LSASS
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 LSASS MiniDump via rundll32.exe + comsvcs.dll (LOL Technique)
Expected signal: Sysmon Event ID 1: rundll32.exe with comsvcs.dll and MiniDump in command line. Sysmon Event ID 11: lsass.dmp created in C:\Windows\Temp\. Windows Security Event ID 4656: handle to lsass.exe requested.
- Test 2 LSASS Dump via ProcDump
Expected signal: Sysmon Event ID 1: procdump.exe with -ma and lsass in command line. Sysmon Event ID 10: procdump64.exe accessing lsass.exe process.
Response Playbook
Triage
- Identify the process and user account that accessed LSASS. Is this a known security tool (Defender, CrowdStrike, SentinelOne), Windows error reporting, or an unknown process? Unknown process = immediate escalation.
- For rundll32 + comsvcs MiniDump: this is an extremely specific LOL technique with almost no legitimate use case. Any detection of this command line targeting lsass.exe should be treated as an active credential dump.
- For ProcDump: check if this is a known diagnostic tool invocation by IT staff. Any ProcDump targeting lsass.exe outside of an authorised debug session is high confidence credential theft.
- For .dmp file creation in temp directories: identify the dump file path and hash it for threat intelligence lookup. Retrieve the dump file if it still exists for forensic analysis.
- Determine what credentials were on the system at the time of the dump: which admin accounts had active sessions? Those accounts should be treated as compromised.
Containment
- Isolate the affected host immediately via EDR isolation.
- Reset all credentials of accounts that had active sessions on the host at the time of the dump — NTLM hashes for all those accounts are now in attacker hands.
- Rotate domain admin passwords and invalidate Kerberos tickets (run klist purge on all domain controllers for the dumped accounts).
- Assess whether lateral movement has already occurred using the dumped credentials: check authentication logs for network logons from the affected host to other internal systems.
- Enable Protected Users security group membership for privileged accounts — members of Protected Users cannot be included in LSASS memory as cleartext credentials.
Evidence Collection
- The dump file itself (if still on disk): contains credential material for forensic analysis
- Sysmon Event ID 10: lsass.exe process access with calling process details
- Sysmon Event ID 1: command line of ProcDump or rundll32 MiniDump
- Windows Security Event ID 4656: handle to lsass.exe object
- Memory forensics from the affected host (if acquired before isolation)
Escalation Criteria
- !rundll32.exe + comsvcs.dll + MiniDump + lsass — immediate incident declaration, no further analysis needed before response
- !Domain admin or service account credential material was available in LSASS at time of dump
- !LSASS dump followed by network authentication from compromised credentials to other hosts
- !Multiple hosts with LSASS dump activity in short time window — indicates pre-ransomware credential harvest
Investigation Guide
Related Techniques
Forensic Artifacts
- >
LSASS dump file (lsass.dmp, lsass.mdmp): contains NTLM hashes, Kerberos tickets - >
Sysmon Event ID 10: process access events to lsass.exe with PROCESS_VM_READ access right - >
Windows Security Event ID 4656/4663: handle requests to lsass.exe - >
Prefetch: PROCDUMP.EXE-*.pf or RUNDLL32.EXE-*.pf with execution timestamps - >
Memory forensics: extract credentials from LSASS using Volatility for incident evidence
Tuning Guidance
The highest-fidelity signal is rundll32.exe + comsvcs + MiniDump — create a zero-tolerance alert for this specific command pattern with no exceptions. For Sysmon Event ID 10 (process access to lsass), the exclusion list of security products is critical — without it, most EDRs will generate excessive false positives as they legitimately read LSASS memory. Build the exclusion list based on the security products deployed in your environment. For ProcDump, the most important tuning is to only alert when lsass.exe is named as a target — ProcDump has legitimate use for debugging other processes.
Hunting Queries
Hunt for any process accessing LSASS memory (Sysmon Event ID 10 — process access) excluding known security products. Even low-volume access outside the whitelist is suspicious and may indicate custom credential theft tooling that isn't ProcDump or Mimikatz.
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType =~ "CreateRemoteThreadApiCall"
| where FileName =~ "lsass.exe"
| where InitiatingProcessFileName !in~ (
"svchost.exe", "wininit.exe", "lsm.exe", "csrss.exe",
"MsMpEng.exe", "SenseIR.exe", "CSFalconService.exe", "SentinelAgent.exe"
)
| project Timestamp, DeviceName, AccountName,
InitiatingProcessFileName, InitiatingProcessCommandLineindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10
TargetImage="*lsass.exe"
NOT (SourceImage IN ("*svchost.exe","*wininit.exe","*lsm.exe","*csrss.exe",
"*MsMpEng.exe","*SenseIR.exe","*CSFalconService.exe","*SentinelAgent.exe"))
| stats count BY SourceImage, SourceCommandLine, host
| sort - countAtomic Red Team Tests
Dumps LSASS memory using the Windows-native comsvcs.dll MiniDump function via rundll32.exe — the living-off-the-land LSASS dump technique used by Akira, Black Basta, and LockBit to avoid dropping Mimikatz.
Command
powershell -Command "$lsassPid = (Get-Process lsass).Id; rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump $lsassPid C:\Windows\Temp\lsass.dmp full"Cleanup
Remove-Item C:\Windows\Temp\lsass.dmp -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: rundll32.exe with comsvcs.dll and MiniDump in command line. Sysmon Event ID 11: lsass.dmp created in C:\Windows\Temp\. Windows Security Event ID 4656: handle to lsass.exe requested.
Expected Detection
Alert fires on rundll32_comsvcs_MiniDump method with RiskScore=95. Immediate escalation required.
Uses Sysinternals ProcDump to create a full memory dump of the LSASS process. This is equivalent to what attackers do when they have ProcDump available on the system.
Command
procdump.exe -accepteula -ma lsass.exe C:\Windows\Temp\lsass_pd.dmpCleanup
Remove-Item C:\Windows\Temp\lsass_pd.dmp -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: procdump.exe with -ma and lsass in command line. Sysmon Event ID 10: procdump64.exe accessing lsass.exe process.
Expected Detection
Alert fires on ProcDump_LSASS method with RiskScore=90.