Sigma rule: LSASS Process Memory Dump Files

Rule

Title

LSASS Process Memory Dump Files

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2021-11-15

Modified

2024-10-08

File

rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

Log source

product

windows

category

file_event

Detection

selection_1:
    TargetFilename|endswith:
        - '\Andrew.dmp'
        - '\Coredump.dmp'
        - '\lsass.dmp'
        - '\lsass.rar'
        - '\lsass.zip'
        - '\NotLSASS.zip'  # https://github.com/CCob/MirrorDump
        - '\PPLBlade.dmp'  # https://github.com/tastypepperoni/PPLBlade
        - '\rustive.dmp' # https://github.com/safedv/RustiveDump/blob/main/src/main.rs#L35
selection_2:
    TargetFilename|contains:
        - '\lsass_2'  # default format of procdump v9.0 is lsass_YYMMDD_HHmmss.dmp
        - '\lsassdmp'
        - '\lsassdump'
selection_3:
    TargetFilename|contains|all:
        - '\lsass'
        - '.dmp'
selection_4:
    TargetFilename|contains: 'SQLDmpr'
    TargetFilename|endswith: '.mdmp'
selection_5:
    TargetFilename|contains:
        - '\nanodump'
        - '\proc_' # NativeDump pattern https://github.com/ricardojoserf/NativeDump/blob/01d8cd17f31f51f5955a38e85cd3c83a17596175/NativeDump/Program.cs#L258
    TargetFilename|endswith: '.dmp'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.t1003.001

MITRE ATT&CK ids this rule names

• T1003.001

Related rules

• db2110f3-479d-42a6-94fb-d35bc1e46492 (obsolete)
• 5e3d3601-0662-4af0-b1d2-36a05e90c40a (obsolete)

References

• https://www.google.com/search?q=procdump+lsass
• https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf
• https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml
• https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/
• https://github.com/helpsystems/nanodump
• https://github.com/CCob/MirrorDump
• https://github.com/safedv/RustiveDump/blob/1a9b026b477587becfb62df9677cede619d42030/src/main.rs#L35
• https://github.com/ricardojoserf/NativeDump/blob/01d8cd17f31f51f5955a38e85cd3c83a17596175/NativeDump/Program.cs#L258

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml