Sigma rule: LSASS Dump Keyword In CommandLine

Rule

Title

LSASS Dump Keyword In CommandLine

Status

test

Level

high

Author

E.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Date

2019-10-24

Modified

2023-08-29

File

rules/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

Log source

product

windows

category

process_creation

Detection

selection:
    - CommandLine|contains:
          - 'lsass.dmp'
          - 'lsass.zip'
          - 'lsass.rar'
          - 'Andrew.dmp'
          - 'Coredump.dmp'
          - 'NotLSASS.zip'  # https://github.com/CCob/MirrorDump
          - 'lsass_2'  # default format of procdump v9.0 is lsass_YYMMDD_HHmmss.dmp
          - 'lsassdump'
          - 'lsassdmp'
    - CommandLine|contains|all:
          - 'lsass'
          - '.dmp'
    - CommandLine|contains|all:
          - 'SQLDmpr'
          - '.mdmp'
    - CommandLine|contains|all:
          - 'nanodump'
          - '.dmp'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.credential-access
• attack.t1003.001

MITRE ATT&CK ids this rule names

• T1003.001

Related rules

• a5a2d357-1ab8-4675-a967-ef9990a59391 (derived)

References

• https://github.com/Hackndo/lsassy
• https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf
• https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml
• https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/
• https://github.com/helpsystems/nanodump
• https://github.com/CCob/MirrorDump

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml