OS Credential Dumping detection rulesT1003

Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.

antivirus

Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

windows · process_creation

Detects well-known credential dumping tools execution via specific named pipe creation

windows · pipe_created

Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory

windows · file_event

Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

windows · process_creation

Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

windows · process_creation

Detects a dump file written by QuarksPwDump password dumper

windows · file_event

Detects the execution of the hacktool Rubeus via PE information of command line parameters

windows · process_creation

Detects the execution of the hacktool SafetyKatz via PE information and default Image name

windows · process_creation

Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks.

windows · process_creation

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

windows · process_creation

Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

windows · process_creation

Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity

windows · process_creation

Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process

windows · registry_event

Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike

windows · process_creation

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

windows

Detects the use of Windows Credential Editor (WCE)

windows · registry_event

Files with well-known filenames (sensitive files with credential data) copying

windows · process_creation

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information

windows · ps_script

Detects uses of the createdump.exe LOLOBIN utility to dump process memory

windows · process_creation

Files with well-known filenames (parts of credential dump software or files produced by them) creation

windows · file_event

Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.

windows · process_access

Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.

windows · process_access

Detects well-known credential dumping tools execution via service execution events

windows

Detects well-known credential dumping tools execution via service execution events

windows

Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.

windows

Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers

windows

Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

windows · process_creation

Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.

windows · registry_event

Detects file creation events with filename patterns used by CrackMapExec.

windows · file_event

Detects suspicious process patterns found in logs when CrackMapExec is used

windows · process_creation

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

windows · process_creation

Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods

windows · process_creation

Detects process access requests from hacktool processes based on their default image name

windows · process_access

Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles

windows · process_access

Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

windows · process_creation

Detects file creation events with filename patterns used by Impacket.

windows · file_event

Detection well-known mimikatz command line arguments

windows · process_creation

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

windows · file_event

Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

windows · process_creation

Detects usage of the Quarks PwDump tool via commandline arguments

windows · process_creation

Detects the execution of the hacktool Rubeus using specific command line flags

windows · ps_script

Detects default lsass dump filename generated by SafetyKatz.

windows · file_event

Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.

windows · process_creation

Detects suspicious use of XORDump process memory dumping utility

windows · process_creation

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

windows · process_creation

Detect attempt to enable auditing of TTY input

linux

Detects usage of a PowerShell command to dump the live memory of a Windows machine

windows · ps_script

Detects Access to LSASS Process

windows

Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference

windows · process_access

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.

windows · process_creation

Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.

windows · registry_set

Detects LSASS process access requests from a source process with the "dump" keyword in its image name.

windows · process_access

Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.

windows · process_access

Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service). This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.

windows

Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.

windows · file_event

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.

windows · file_event

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

windows · file_event

Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

windows · process_creation

Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

windows · process_creation

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

windows

Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.

windows · file_event

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

windows · file_event

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory

windows · file_event

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.

opencanary · application

Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.

opencanary · application

Detects instances where a MySQL service on an OpenCanary node has had a login attempt.

opencanary · application

Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.

opencanary · application

Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN

windows

Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.

windows · create_remote_thread

Detect AD credential dumping using impacket secretdump HKTL

windows

Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

zeek

Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

windows · process_creation

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

windows · process_creation

Detects remote thread creation by PowerShell processes into "lsass.exe"

windows · create_remote_thread

Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass

windows · process_creation

Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.

windows · ps_script

Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers. LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory. Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.

windows · process_creation

Detects usage of cmdkey to look for cached credentials on the system

windows · process_creation

Detects the creation of files that look like exports of the local SAM (Security Account Manager)

windows · file_event

Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name

windows · process_creation

Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.

windows · process_creation

Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location

windows · registry_set

Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity

windows · ps_script

Detects suspicious PowerShell scripts accessing SAM hives

windows · process_creation

Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.

windows · process_creation

Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory

windows · process_creation

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

windows · process_creation

Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory

windows · process_creation

Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.

windows · process_creation

Detects execution of MemProcFS a memory forensics tool with the '-device' parameter. MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures. Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials. MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.

windows · process_creation

Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. These files generally contain various user-specific registry settings and are typically located in the user's profile directory. Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings for persistence, privilege escalation, or dump user registry hives for credential harvesting.

windows · file_event

Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.

windows · process_access

Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory

windows · process_creation

Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.

windows · process_creation

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

windows · process_creation

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

windows · process_creation

Detects suspicious ways to use the "DumpMinitool.exe" binary

windows · process_creation

Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers

windows · ps_module

Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.

windows · image_load

Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.

windows · process_access

Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace. These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll, dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques.

windows · process_access

Detects suspicious process patterns used in NTDS.DIT exfiltration

windows · process_creation

Detects rundll32 loading a renamed comsvcs.dll to dump process memory

windows · image_load

Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

windows · process_creation

Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.

windows · image_load

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

windows · process_creation

Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

windows · image_load

Shadow Copies storage symbolic link creation using operating systems utilities

windows · process_creation

Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials

windows · file_event

Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing.

windows · file_access

Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

windows

Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

windows · process_creation

Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.

windows

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

windows · file_access

Detects the load of dbghelp/dbgcore DLL by a potentially uncommon or potentially suspicious process. The Dbghelp and Dbgcore DLLs export functions that allow for the dump of process memory. Tools like ProcessHacker, Task Manager and some attacker tradecraft use the MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine. Keep in mind that many legitimate Windows processes and services might load the aforementioned DLLs for debugging or other related purposes. Investigate the CommandLine and the Image location of the process loading the DLL.

windows · image_load

Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.

windows

Detects process dump via legitimate sqldumper.exe binary

windows · process_creation

Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

windows · process_creation

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

windows · process_creation

Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json. The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data. Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials. Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.

windows

Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)

windows · process_creation

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

windows · process_creation

Detects potential mimikatz-like tools accessing LSASS from non system account

windows

Detects process access to LSASS memory with suspicious access flags and from a potentially suspicious folder

windows · process_access

Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP session via command line interface.

windows · process_creation

Detects potential abuse of ntdsutil to dump ntds.dit database

windows

Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.

windows · process_access

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

windows · registry_set

Detects a PowerShell process requesting access to "lsass.exe", which can be indicative of potential credential dumping attempts

windows · process_access

Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2. Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges. These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets. CVE-2025-5054: Information leak via core dumps from SUID binaries using apport. CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.

linux · process_creation

Detects process handle on LSASS process with certain access mask

windows

Detects process access requests to LSASS process with potentially suspicious access flags

windows · process_access

Detects usage of the SysInternals Procdump utility

windows · process_creation

Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.

aws

Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.

azure

Shadow Copies creation using operating systems utilities, possible credential access

windows · process_creation

The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

windows · ps_script

Detects suspicious Active Directory Replication Service (ADRS) requests originating from a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller. Under normal operation, only Domain Controllers initiate replication requests carrying the DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account credentials — for example by abusing certificate-based authentication (PKINIT) to impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost), where a temporary machine account is created to request a DC certificate and then used to perform DCSync — they can dump all domain credential material including the krbtgt hash.

windows

Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.

windows · process_creation

Transferring files with well-known filenames (sensitive files with credential data) using network shares

windows

Transferring files with well-known filenames (sensitive files with credential data) using network shares

zeek

Detects process access to LSASS memory with uncommon access flags 0x410 and 0x01410

windows · process_access

Loading unsigned image (DLL, EXE) into LSASS process

windows · image_load

Detects file access requests to browser credential stores by uncommon processes. Could indicate potential attempt of credential stealing. Requires heavy baselining before usage

windows · file_access

Detects file access requests to chromium based browser sensitive files by uncommon processes. Could indicate potential attempt of stealing sensitive information.

windows · file_access

Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.

windows · process_creation

Detects creation of a file named "ntds.dit" (Active Directory Database)

windows · file_event

Detects volume shadow copy mount via Windows event log

windows

Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.

windows