title: LSASS Memory Dump File Creation
id: 5e3d3601-0662-4af0-b1d2-36a05e90c40a
description: LSASS memory dump creation using operating systems utilities. Procdump will use process name in output file if no name is specified
author: Teymur Kheirkhabarov, oscd.community
references:
    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
date: 2019/10/22
modified: 2020/08/23
tags:
    - attack.credential_access
    - attack.t1003         # an old one
    - attack.t1003.001
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: 'lsass'
        TargetFilename|endswith: 'dmp'
    condition: selection
fields:
    - ComputerName
    - TargetFileName
falsepositives:
    - Dumping lsass memory for forensic investigation purposes by legitimate incident responder or forensic invetigator
level: medium
status: experimental
