| sigma |
LSASS Access From Non System Account |
test |
2026-10-20 |
| sigma |
Potentially Suspicious GrantedAccess Flags On LSASS |
test |
2026-10-20 |
| sigma |
Potentially Suspicious AccessMask Requested From LSASS |
test |
2026-10-20 |
| splunk |
Windows Possible Credential Dumping |
production |
2026-10-09 |
| splunk |
Detect Credential Dumping through LSASS access |
production |
2026-10-09 |
| splunk |
Windows Non-System Account Targeting Lsass |
production |
2026-10-09 |
| splunk |
Access LSASS Memory for Dump Creation |
production |
2026-10-09 |
| elastic |
Suspicious Lsass Process Access |
production |
2026-10-05 |
| splunk |
Windows Credential Dumping LSASS Memory Createdump |
production |
2026-10-02 |
| splunk |
Dump LSASS via procdump |
production |
2026-10-02 |
| splunk |
Creation of lsass Dump with Taskmgr |
production |
2026-10-02 |
| splunk |
Dump LSASS via comsvcs DLL |
production |
2026-10-02 |
| elastic |
LSASS Process Access via Windows API |
production |
2026-09-22 |
| elastic |
Potential Credential Access via LSASS Memory Dump |
production |
2026-09-18 |
| elastic |
Credential Dumping - Detected - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Credential Dumping - Prevented - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Windows Utilities |
production |
2026-09-18 |
| elastic |
Full User-Mode Dumps Enabled System-Wide |
production |
2026-09-18 |
| elastic |
PowerShell Kerberos Ticket Dump |
production |
2026-09-18 |
| elastic |
Potential LSASS Memory Dump via PssCaptureSnapShot |
production |
2026-09-18 |
| elastic |
PowerShell MiniDump Script |
production |
2026-09-18 |
| elastic |
Potential Credential Access via DuplicateHandle in LSASS |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Renamed COM+ Services DLL |
production |
2026-09-18 |
| elastic |
Suspicious LSASS Access via MalSecLogon |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Disabling Lsa Protection via Registry Modification |
production |
2026-09-18 |
| elastic |
Potential LSASS Clone Creation via PssCaptureSnapShot |
production |
2026-09-18 |
| elastic |
Suspicious Module Loaded by LSASS |
production |
2026-09-18 |
| elastic |
LSASS Memory Dump Creation |
production |
2026-09-18 |
| elastic |
LSASS Memory Dump Handle Access |
production |
2026-09-18 |
| elastic |
Potential Invoke-Mimikatz PowerShell Script |
production |
2026-09-18 |
| elastic |
Modification of WDigest Security Provider |
production |
2026-09-18 |
| sigma |
HackTool - Dumpert Process Dumper Execution |
test |
2026-09-16 |
| sigma |
LSASS Access From Program In Potentially Suspicious Folder |
test |
2026-09-15 |
| sigma |
Procdump Execution |
test |
2026-06-29 |
| splunk |
Create Remote Thread into LSASS |
production |
2026-06-29 |
| sigma |
Potential Credential Dumping Activity Via LSASS |
test |
2026-06-29 |
| sigma |
Antivirus - Password Dumper Signature |
stable |
2026-06-15 |
| splunk |
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity |
production |
2026-05-13 |
| splunk |
Windows Hunting System Account Targeting Lsass |
production |
2026-05-13 |
| sigma |
PUA - Memory Dump Mount Via MemProcFS |
experimental |
2026-04-27 |
| sigma |
HackTool - WSASS Execution |
experimental |
2026-01-09 |
| sigma |
LSASS Process Crashed - Application |
experimental |
2025-12-03 |
| sigma |
Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs |
experimental |
2025-11-27 |
| sigma |
PPL Tampering Via WerFaultSecure |
experimental |
2025-11-23 |
| sigma |
Cred Dump Tools Dropped Files |
test |
2025-10-25 |
| sigma |
HackTool - Windows Credential Editor (WCE) Execution |
test |
2025-10-21 |
| sigma |
Potential LSASS Process Dump Via Procdump |
stable |
2025-10-19 |
| sigma |
Transferring Files with Credential Data via Network Shares |
test |
2025-07-11 |
| sigma |
HackTool - Doppelanger LSASS Dumper Execution |
experimental |
2025-07-01 |
| sigma |
HackTool - Impacket File Indicators |
experimental |
2025-05-19 |
| sigma |
Process Memory Dump Via Comsvcs.DLL |
test |
2025-02-23 |
| sigma |
HackTool - HandleKatz LSASS Dumper Execution |
test |
2024-11-23 |
| sigma |
HackTool - CreateMiniDump Execution |
test |
2024-11-23 |
| sigma |
LSASS Process Memory Dump Files |
test |
2024-10-08 |
| sigma |
Process Memory Dump via RdrLeakDiag.EXE |
test |
2024-08-15 |
| sigma |
HackTool - SafetyKatz Dump Indicator |
test |
2024-06-27 |
| sigma |
HackTool - CrackMapExec File Indicators |
test |
2024-06-27 |
| sigma |
Potential Windows Defender AV Bypass Via Dump64.EXE Rename |
test |
2024-06-21 |
| sigma |
Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process |
test |
2024-03-01 |
| sigma |
Uncommon GrantedAccess Flags On LSASS |
test |
2023-11-30 |
| sigma |
Credential Dumping Attempt Via WerFault |
test |
2023-11-29 |
| sigma |
Lsass Memory Dump via Comsvcs DLL |
test |
2023-11-29 |
| sigma |
LSASS Memory Access by Tool With Dump Keyword In Name |
test |
2023-11-29 |
| sigma |
Credential Dumping Activity By Python Based Tool |
stable |
2023-11-29 |
| sigma |
Remote LSASS Process Access Through Windows Remote Management |
stable |
2023-11-29 |
| sigma |
LSASS Access From Potentially White-Listed Processes |
test |
2023-11-29 |
| sigma |
HackTool - HandleKatz Duplicating LSASS Handle |
test |
2023-11-28 |
| sigma |
Potential Credential Dumping Attempt Via PowerShell |
test |
2023-11-28 |
| sigma |
HackTool - Generic Process Access |
test |
2023-11-27 |
| sigma |
LSASS Process Memory Dump Creation Via Taskmgr.EXE |
test |
2023-10-19 |
| sigma |
LSASS Dump Keyword In CommandLine |
test |
2023-08-29 |
| sigma |
Lsass Full Dump Request Via DumpType Registry Settings |
test |
2023-08-17 |
| sigma |
HackTool - Credential Dumping Tools Named Pipe Created |
test |
2023-08-07 |
| sigma |
Potential Adplus.EXE Abuse |
test |
2023-06-23 |
| sigma |
HackTool - Dumpert Process Dumper Default File |
test |
2023-05-09 |
| sigma |
Potential SysInternals ProcDump Evasion |
test |
2023-05-09 |
| sigma |
Suspicious DumpMinitool Execution |
test |
2023-04-12 |
| sigma |
DumpMinitool Execution |
test |
2023-04-12 |
| sigma |
APT31 Judgement Panda Activity |
test |
2023-03-10 |
| sigma |
Potential Credential Dumping Via LSASS Process Clone |
test |
2023-03-02 |
| sigma |
HackTool - Mimikatz Execution |
test |
2023-02-21 |
| sigma |
Suspicious Renamed Comsvcs DLL Loaded By Rundll32 |
test |
2023-02-17 |
| sigma |
Renamed CreateDump Utility Execution |
test |
2023-02-14 |
| sigma |
HackTool - CrackMapExec Process Patterns |
test |
2023-02-13 |
| sigma |
HackTool - XORDump Execution |
test |
2023-02-08 |
| sigma |
HackTool - SafetyKatz Execution |
test |
2023-02-04 |
| sigma |
HackTool - Inveigh Execution |
test |
2023-02-04 |
| sigma |
PowerShell Get-Process LSASS in ScriptBlock |
test |
2022-12-25 |
| sigma |
Potential Credential Dumping Via LSASS SilentProcessExit Technique |
test |
2022-12-19 |
| sigma |
Potential Credential Dumping Attempt Via PowerShell Remote Thread |
test |
2022-12-18 |
| sigma |
NotPetya Ransomware Activity |
test |
2022-12-15 |
| sigma |
Potential Credential Dumping Via WER |
test |
2022-12-09 |
| sigma |
Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded |
test |
2022-12-09 |
| sigma |
LSASS Process Dump Artefact In CrashDumps Folder |
test |
2022-12-08 |
| sigma |
Time Travel Debugging Utility Usage - Image |
test |
2022-12-02 |
| sigma |
Credential Dumping Tools Service Execution - Security |
test |
2022-11-29 |
| sigma |
Credential Dumping Tools Service Execution - System |
test |
2022-11-29 |
| sigma |
Password Dumper Activity on LSASS |
test |
2022-10-09 |
| sigma |
Time Travel Debugging Utility Usage |
test |
2022-10-09 |
| sigma |
CreateDump Process Dump |
test |
2022-08-19 |
| sigma |
LSASS Access Detected via Attack Surface Reduction |
test |
2022-08-13 |
| sigma |
Suspicious LSASS Access Via MalSecLogon |
test |
2022-06-29 |
| sigma |
WerFault LSASS Process Memory Dump |
test |
2022-06-27 |
| sigma |
Process Access via TrolleyExpress Exclusion |
test |
2022-05-13 |
| sigma |
Mimikatz Use |
test |
2022-01-05 |
| sigma |
Unsigned Image Loaded Into LSASS Process |
test |
2021-11-27 |
| sigma |
Dumping Process via Sqldumper.exe |
test |
2021-11-27 |
| sigma |
Windows Credential Editor Registry |
test |
2021-11-27 |
| sigma |
Transferring Files with Credential Data via Network Shares - Zeek |
test |
2021-11-27 |
| sigma |
Password Dumper Remote Thread in LSASS |
stable |
2021-06-21 |