LSASS Dump Keyword In CommandLine

Severity: high
Author: E.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `selection`

or:
CommandLine|contains: .dmp
CommandLine|contains: lsass
CommandLine|contains: .dmp
CommandLine|contains: nanodump
CommandLine|contains: .mdmp
CommandLine|contains: SQLDmpr
CommandLine|contains: Andrew.dmp
CommandLine|contains: Coredump.dmp
CommandLine|contains: NotLSASS.zip
CommandLine|contains: lsass.dmp
CommandLine|contains: lsass.rar
CommandLine|contains: lsass.zip
CommandLine|contains: lsass_2
CommandLine|contains: lsassdmp
CommandLine|contains: lsassdump

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.