Detection of LSASS Memory Dumping via Command Line Keywords

hello@craftedsignal.io — Thu, 03 Sep 2026 12:45:24 +0000

This brief addresses the detection of unauthorized attempts to dump the memory contents of the Local Security Authority Subsystem Service (LSASS) process. Attackers frequently target LSASS to extract sensitive credentials, such as cleartext passwords, NTLM hashes, and Kerberos tickets, which can then be used for lateral movement and privilege escalation. Common techniques for dumping LSASS memory include the use of legitimate system tools like procdump, specialized post-exploitation frameworks like nanodump or MirrorDump, and various custom scripts. These methods often involve creating output files containing the process memory. Monitoring process creation logs for specific command-line indicators - such as filenames containing 'lsass' or extension markers like '.dmp' - allows security teams to identify and respond to credential access attempts in real-time. This detection logic is critical for identifying post-exploitation activity where attackers attempt to bypass traditional credential dumping tools that might otherwise be blocked by security software.

Impact

Successful dumping of LSASS memory provides attackers with the necessary credentials to escalate privileges to Domain Admin or perform lateral movement across the network. Compromised credentials can lead to full domain compromise, data exfiltration, and long-term persistence within an organization's environment. Because LSASS dumping is a precursor to further malicious actions, identifying this behavior early in the attack lifecycle is essential for limiting the blast radius of an intrusion.

Recommendation

Deploy the provided Sigma rule to monitor for command-line arguments involving LSASS memory dump operations.
Enable Sysmon or Windows Event Log (Event ID 4688) with full command-line logging to ensure visibility into process execution.
Investigate any triggered alerts immediately to distinguish between malicious activity and authorized administrative or diagnostic tasks.
Supplement process-based detection with memory access monitoring (e.g., using EDR telemetry) to detect direct calls to the LSASS process, as some advanced tools may avoid standard command-line indicators.

Detection of Windows Defender Malware and Suspicious Activity Events

hello@craftedsignal.io — Thu, 03 Sep 2026 12:35:07 +0000

This brief focuses on the operational visibility provided by Windows Defender's native logging capabilities, specifically regarding malware and suspicious activity detections. Security operations teams can leverage Event IDs 1006, 1015, 1116, and 1117 to identify when the antimalware engine blocks malicious files or identifies potentially unwanted programs (PUPs). Monitoring these events is essential for incident response, as they provide high-fidelity indicators that a security control has engaged to protect the endpoint. These logs facilitate the identification of compromised hosts, persistent threat attempts, and the efficacy of current defensive policies. Defenders should ingest these events to maintain situational awareness of security product triggers across the fleet.

Impact

Successful detection of these events allows for the rapid identification of active threats on an endpoint. If these detections are ignored, attackers may maintain persistence through obfuscated malware or bypass security controls by repeatedly attempting to execute known malicious binaries that have already been flagged by the system.

Recommendation

Deploy the Sigma rules below to your SIEM to monitor for high-confidence security triggers.
Configure the Windows Event Log collection to capture Microsoft-Windows-Windows Defender/Operational logs.
Integrate these detections into your automated incident response playbooks for rapid host isolation upon a confirmed malware detection (Event ID 1116).
Review the frequency of these detections per endpoint to identify systems that may be repeatedly targeted or infected, indicating a need for deeper forensic investigation.

Security-Monitoring - CraftedSignal Threat Feed

Detection of LSASS Memory Dumping via Command Line Keywords

Impact

Recommendation

Detection of Windows Defender Malware and Suspicious Activity Events

Impact

Recommendation