
title: LSASS Memory Dump File Creation
author: Teymur Kheirkhabarov, oscd.community
date: 2019/10/22
description: LSASS memory dump creation using operating systems utilities. Procdump
  will use process name in output file if no name is specified
detection:
  SELECTION_1:
    EventID: 11
  SELECTION_2:
    TargetFilename: '*lsass*'
  SELECTION_3:
    TargetFilename: '*dmp'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- Dumping lsass memory for forensic investigation purposes by legitimate incident
  responder or forensic invetigator
- Dumps of another process that contains lsass in its process name (substring)
fields:
- ComputerName
- TargetFilename
id: 5e3d3601-0662-4af0-b1d2-36a05e90c40a
level: high
logsource:
  category: file_event
  product: windows
modified: 2021/08/16
references:
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
status: experimental
tags:
- attack.credential_access
- attack.t1003
- attack.t1003.001
ruletype: SIGMA
