Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.
Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.
When hunting for credential theft activity in the environment
After compromise indicators suggest attacker has elevated privileges
When EDR alerts fire for LSASS access or suspicious process memory reads
During incident response to determine scope of credential compromise
When auditing LSASS protection controls (Credential Guard, RunAsPPL)
Detection Gaps & Validation
GrantedAccess masking: rules pinned to 0x1FFFFF/0x1010 miss tools that open LSASS with minimal rights — modern dumpers request 0x1438/0x1410 or clone the handle via PROCESS_DUP_HANDLE (0x0040). Match the EID 10 CallTrace (into dbgcore.dll/dbghelp.dll/ntdll!NtReadVirtualMemory) rather than a single mask.
PPL/Credential Guard gaps: if RunAsPPL or Credential Guard is not enabled, plaintext is recoverable and some EDRs suppress the alert — confirm protection state; conversely handle-clone and MiniDumpWriteDump evade many EID 10 rules.
Disk-based paths bypass LSASS rules entirely: NTDS.dit via vssadmin create shadow + ntdsutil ifm, and reg save HKLM\SAM, are 4688/EID 1 command-line hunts — invisible if command-line auditing is off.
DCSync (T1003.006): detect via DC Security EID 4662 with replication GUIDs (DS-Replication-Get-Changes) from a non-DC account; requires directory-service access auditing.
Validate: run Atomic Red Team T1003.001 (comsvcs MiniDump, procdump -ma lsass) and T1003.003 to confirm the EID 10, EID 1, and 4662 searches fire.
Tune FPs: MsMpEng, WerFault, and EDR agents legitimately read LSASS — allowlist by signed SourceImage, not by access mask alone.
Prerequisites
EDR agent deployed with LSASS access monitoring (CrowdStrike, Defender for Endpoint, SentinelOne)
Sysmon Event ID 10 (ProcessAccess) with LSASS-specific filters
Windows Security Event ID 4656/4663 (Object Access Auditing)
LSASS SACL auditing enabled (Windows 10+)
Registry auditing for SAM hive access
Workflow
Monitor LSASS Process Access: Track all processes opening handles to lsass.exe with suspicious access rights (PROCESS_VM_READ 0x0010, PROCESS_ALL_ACCESS 0x1FFFFF). Non-privileged or unusual processes accessing LSASS are strong indicators.
Detect Credential Dumping Tools: Hunt for known tool signatures -- Mimikatz (sekurlsa::logonpasswords), procdump.exe targeting LSASS, comsvcs.dll MiniDump, and Task Manager creating LSASS dumps.
Monitor NTDS.dit Access: Detect Volume Shadow Copy creation (vssadmin, wmic shadowcopy) followed by NTDS.dit file access, or ntdsutil.exe IFM creation.
Track SAM/SECURITY/SYSTEM Hive Access: Hunt for reg.exe save commands targeting SAM, SECURITY, and SYSTEM registry hives.
Detect DCSync Activity: Monitor for non-DC accounts requesting directory replication (Event 4662 with replication GUIDs).
Correlate with Lateral Movement: After credential dumping, attackers typically move laterally. Correlate credential access events with subsequent remote logon attempts.
Assess Impact: Determine which credentials were potentially compromised and initiate password resets.
Key Concepts
Concept
Description
T1003.001
LSASS Memory -- dumping credentials from LSASS process
T1003.002
Security Account Manager -- extracting local account hashes from SAM
T1003.003
NTDS -- extracting domain hashes from Active Directory database
T1003.004
LSA Secrets -- extracting service account passwords
DCSync -- replicating credentials from domain controller
Credential Guard
Virtualization-based isolation of LSASS secrets
RunAsPPL
Protected Process Light for LSASS
Detection Queries
Splunk -- LSASS Access Detection
index=sysmon EventCode=10
| where match(TargetImage, "(?i)lsass\.exe$")
| where GrantedAccess IN ("0x1FFFFF", "0x1F3FFF", "0x143A", "0x1F0FFF", "0x0040", "0x1010", "0x1410")
| where NOT match(SourceImage, "(?i)(csrss|lsass|svchost|MsMpEng|WmiPrvSE|taskmgr|procexp|SecurityHealthService)\.exe$")
| table _time Computer SourceImage SourceProcessId GrantedAccess CallTrace
Splunk -- Credential Dumping Tool Detection
index=sysmon EventCode=1
| where match(CommandLine, "(?i)(sekurlsa|lsadump|kerberos::list|crypto::certificates)")
OR match(CommandLine, "(?i)procdump.*-ma.*lsass")
OR match(CommandLine, "(?i)comsvcs\.dll.*MiniDump")
OR match(CommandLine, "(?i)ntdsutil.*\"ac i ntds\".*ifm")
OR match(CommandLine, "(?i)reg\s+save\s+hklm\\\\(sam|security|system)")
OR match(CommandLine, "(?i)vssadmin.*create\s+shadow")
| table _time Computer User Image CommandLine ParentImage
KQL -- Microsoft Defender for Endpoint
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType in ("LsassAccess", "CredentialDumpingActivity")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName,
InitiatingProcessCommandLine, ActionType, AdditionalFields
| sort by Timestamp desc
