Skip to content
Threat Feed
Subscribe
high advisory

Potential Credential Dumping via LSASS Process Cloning

Adversaries may perform credential dumping by spawning a clone of the Local Security Authority Subsystem Service (LSASS) process.

Triage facts

Revision 1
Evidence
Unknown
Severity
High
Sources
4 public sources
Freshness
Revision 1Nov 10, 02:51 UTC
Detection
1 rule
Source quality
A2Roughly even chance

Detection of a suspicious LSASS process clone that could be a sign of credential dumping activity. This technique involves an instance of the lsass.exe process being spawned by another lsass.exe process.

Recommendation

  • Deploy the Sigma rule (ID: c8da0dfd-4ed0-4b68-962d-13c9c884384e) to detect process creation events where lsass.exe is the parent of another lsass.exe instance.

Detection coverage 1

Potential Credential Dumping Via LSASS Process Clone

critical
sigma tactics: credential-access techniques: T1003, T1003.001 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →