Detection of LSASS Memory Dumping via Sysmon

Adversaries frequently target the Local Security Authority Subsystem Service (LSASS) process on Windows systems to extract sensitive credentials, including plaintext passwords, NTLM hashes, and Kerberos tickets. By dumping the process memory of lsass.exe, attackers can facilitate privilege escalation, lateral movement, and persistence. This activity is a hallmark of sophisticated post-exploitation toolkits and is commonly associated with ransomware operations (e.g., Cactus Ransomware) and information stealers (e.g., Lokibot). Defenders should monitor for unauthorized processes attempting to obtain handle access to lsass.exe using specific system debugging libraries. The detection focuses on Sysmon Event ID 10 logs identifying calls to dbgcore.dll or dbghelp.dll, which are standard components used by dumping utilities.

Attack Chain

1. The attacker gains initial access to a Windows host.
2. The attacker elevates privileges to Administrator or SYSTEM level.
3. The attacker deploys a memory-dumping tool or executes native Windows commands (e.g., ProcDump, comsvcs.dll via rundll32.exe).
4. The dumping tool initiates a process handle request to lsass.exe with specific access rights (e.g., PROCESS_QUERY_LIMITED_INFORMATION or PROCESS_VM_READ).
5. The dumping tool utilizes the Windows APIs dbghelp.dll or dbgcore.dll to facilitate the memory read operation.
6. The memory dump file (e.g., lsass.dmp) is written to the local disk.
7. The attacker exfiltrates the dump file or processes it locally using tools like Mimikatz to extract credentials.

Impact

Successful LSASS memory dumping grants an adversary access to cleartext credentials and authentication material for all users logged into the system. This level of access typically leads to full domain compromise, as attackers can leverage stolen administrative credentials to move laterally, access critical servers, and deploy ransomware or exfiltrate sensitive data.

Recommendation

1. Enable Windows Sysmon and configure Event ID 10 (ProcessAccess) logging to track handles requested against lsass.exe.
2. Deploy the provided Sigma rule to identify suspicious library imports associated with memory dumping.
3. Audit environments for the presence of known credential dumping tools like Mimikatz, ProcDump, or Cobalt Strike beacons.
4. Restrict administrative privileges to limit the ability of non-privileged users to request handles on sensitive system processes.