OS Credential Dumping: LSASS Memory `T1003.001`

Tactic: Credential Access

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.

Events covered

29 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 8	CreateRemoteThread
Sysmon	Event ID 10	ProcessAccess
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 17	PipeEvent (Pipe Created)
Sysmon	Event ID 18	PipeEvent (Pipe Connected)
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4661	A handle to an object was requested.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4673	A privileged service was called.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4690	An attempt was made to duplicate a handle to an object.
Security-Auditing	Event ID 4697	A service was installed in the system.
Security-Auditing	Event ID 4703	A user right was adjusted.
Security-Auditing	Event ID 5145	A network share object was checked to see whether client can be granted desired access.
Application-Error	Event ID 1000	Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.
Defender-DeviceEvents	OpenProcessApiCall	Process opened (OpenProcess API call)
Defender-DeviceEvents	ProcessPrimaryTokenModified	Process primary token modified
Kernel-Audit-API-Calls	Event ID 5	OpenProcess API call audited
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
Windows-Defender	Event ID 1121	Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
PowerShell	Event ID 800	Event ID 800
Service-Control-Manager	Event ID 7045	A service was installed in the system.

Authoring guide

Patterns shared across the 168 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (85 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`Image`	58	`ends_with` 44, `contains` 9, `eq` 8, `regex_match` 7, `starts_with` 2, `is_not_null` 1	`\rundll32.exe`, `\\lsass\.exe$`, `\powershell.exe`, `\pwsh.exe`, `?:\windows\system32\lsass.exe`
`CommandLine`	45	`contains` 37, `match` 5, `ends_with` 2, `in` 2, `regex_match` 2, `starts_with` 1, `wildcard` 1	`--full` , `--name` , `-f` , `-ma` , `full`
`TargetImage`	28	`ends_with` 23, `eq` 4, `in` 1	`\lsass.exe`, `lsass.exe`, `?:\windows\system32\lsass.exe`, `\\lsass.exe`, `\system32\lsass.exe`
`EventID`	25	`eq` 24, `in` 1	`4688`, `10`, `1`, `4656`, `11`
`OriginalFileName`	19	`eq` 18, `contains` 1, `is_null` 1	`fx_ver_internalname_str`, `procdump`, `dumpminitool.arm64.exe`, `dumpminitool.exe`, `dumpminitool.x86.exe`
`process_name`	19	`eq` 9, `ends_with` 8, `contains` 3, `in` 1, `is_not_null` 1, `match` 1, `starts_with` 1, `wildcard` 1	`\lsass.exe`, `:\program files (x86)\`, `:\program files\`, `procdump.exe`, `rundll32.exe`
`GrantedAccess`	17	`eq` 14, `ends_with` 5, `contains` 1, `in` 1, `starts_with` 1	`0x1010`, `0x1410`, `0x1fffff`, `0x1418`, `0x1438`
`TargetFilename`	16	`contains` 8, `ends_with` 7, `regex_match` 6, `starts_with` 2, `eq` 1	`.dmp`, `\.dmp$`, `\lsass`, `lsass.dmp`, `.mdmp`
`CallTrace`	13	`contains` 12, `ends_with` 1, `in` 1, `match` 1, `starts_with` 1	`dbgcore.dll`, `dbghelp.dll`, `seclogon.dll`, `)`, `dbgcore.dll`
`ParentImage`	9	`eq` 3, `regex_match` 3, `ends_with` 2, `contains` 1	`%hacktool_contains`, `%hacktool_regex`, `:\\windows\\(system32\|syswow64)\\taskmgr\.exe$`, `?:\windows\system32\lsass.exe`, `\\rundll32\.exe$`
`ObjectName`	8	`ends_with` 6, `starts_with` 2	`\lsass.exe`, `CN=`, `DC=`, `S-1-5-21-`, `\System32\lsass.exe`
`Hashes`	7	`contains` 7	`imphash=0e2216679ca6e1094d63322e3412d650`, `imphash=136f0a8572c058a96436c82e541e4c41`, `imphash=281d618f4e6271e527e6386ea6f748de`, `imphash=32f5095c9bbdcacf28fd4060eb4dfc42`, `imphash=38d9e015591bbfd4929e0d0f47fa0055`
`ObjectType`	7	`eq` 7	`Process`, `SAM_DOMAIN`, `SAM_SERVER`, `SAM_USER`
`TargetObject`	7	`contains` 4, `wildcard` 2, `eq` 1	`\system\controlset\control\lsa\runasppl`, `\system\controlset\control\securityproviders\wdigest\u...`, `\registry\machine\software\microsoft\windows\windows...`, `\software\microsoft\windows\windows error...`, `\software\microsoft\windows\windows error...`
`EventType`	6	`eq` 5, `ne` 1	`cred_theft_event`, `IntrusionEvent`, `ProcessPrimaryTokenModified`, `deletion`, `load`

Top indicator values (1419 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Field	Kind	Value	Rules (here)	Corpus reach
`TargetImage`	`ends_with`	`\lsass.exe` sigmaCredential Dumping Activity By Python Based Tool sigmaCredential Dumping Attempt Via WerFault sigmaHackTool - HandleKatz Duplicating LSASS Handle sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaLsass Memory Dump via Comsvcs DLL sigmaPassword Dumper Remote Thread in LSASS sigmaPotential Credential Dumping Activity Via LSASS sigmaPotential Credential Dumping Attempt Via PowerShell sigmaPotential Credential Dumping Attempt Via PowerShell Remote Thread sigmaPotentially Suspicious GrantedAccess Flags On LSASS sigmaRemote LSASS Process Access Through Windows Remote Management sigmaSuspicious LSASS Access Via MalSecLogon sigmaSuspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs sigmaUncommon GrantedAccess Flags On LSASS	16	16
`TargetImage`	`ends_with`	`lsass.exe` splunkAccess LSASS Memory for Dump Creation splunkCreate Remote Thread into LSASS splunkDetect Credential Dumping through LSASS access splunkWindows Hunting System Account Targeting Lsass splunkWindows Non-System Account Targeting Lsass	5	6
`EventID`	`eq`	`4688` splunkCommon LSASS Memory Dump Behavior (Windows Event Log) splunkcomsvcs.dll Lsass Memory Dump (Windows Event Log) splunkMimikatz (Windows Event Log) splunkMultiDump.exe Execution (Windows Event Log) splunkpypykatz commands (Windows Event Log) splunkRdrLeakDiag.exe Memory Dump (Windows Event Log) splunkTask Manager lsass Dump (Windows Event Log) kustoPowershell Empire Cmdlets Executed in Command Line	8	313
`EventID`	`eq`	`10` splunkAccess LSASS Memory for Dump Creation splunkDetect Credential Dumping through LSASS access splunkMimikatz (Sysmon) splunkWindows Hunting System Account Targeting Lsass splunkWindows Non-System Account Targeting Lsass splunkWindows Possible Credential Dumping kustoDumping LSASS Process Into a File	7	16
`EventID`	`eq`	`1` splunkcomsvcs.dll Lsass Memory Dump (Sysmon) splunkMimikatz (Sysmon) splunkMultiDump.exe Execution (Sysmon) splunkRdrLeakDiag.exe Memory Dump (Sysmon)	4	237
`EventID`	`eq`	`4656` splunkCommon LSASS Memory Dump Behavior (Windows Event Log) splunkLSASS Handle request (Windows Event Log) splunkMimikatz (Windows Event Log) splunkTask Manager lsass Dump (Windows Event Log)	4	19
`Image`	`ends_with`	`\rundll32.exe` sigmaDbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process sigmaLSASS credential dump with LSASSY (process) sigmaLsass Memory Dump via Comsvcs DLL sigmaNotPetya Ransomware Activity sigmaProcess Memory Dump Via Comsvcs.DLL sigmaSuspicious Renamed Comsvcs DLL Loaded By Rundll32	6	95
`CommandLine`	`contains`	`.dmp` sigmaHackTool - HandleKatz LSASS Dumper Execution sigmaLSASS Dump Keyword In CommandLine sigmaRenamed CreateDump Utility Execution chronicleLSASS Dump Keyword In CommandLine chronicleRenamed CreateDump Utility Execution	5	10
`CommandLine`	`contains`	`--full` sigmaCreateDump Process Dump sigmaRenamed CreateDump Utility Execution chronicleCreateDump Process Dump chronicleRenamed CreateDump Utility Execution	4	4
`CommandLine`	`contains`	`--name` sigmaCreateDump Process Dump sigmaRenamed CreateDump Utility Execution chronicleCreateDump Process Dump chronicleRenamed CreateDump Utility Execution	4	4
`CommandLine`	`contains`	`-f` sigmaCreateDump Process Dump sigmaRenamed CreateDump Utility Execution chronicleCreateDump Process Dump chronicleRenamed CreateDump Utility Execution	4	8
`CommandLine`	`contains`	`-u` sigmaCreateDump Process Dump sigmaRenamed CreateDump Utility Execution chronicleCreateDump Process Dump chronicleRenamed CreateDump Utility Execution	4	8
`CommandLine`	`contains`	`lsass` sigmaHackTool - HandleKatz LSASS Dumper Execution sigmaLSASS Dump Keyword In CommandLine sigmaPotential SysInternals ProcDump Evasion chronicleLSASS Dump Keyword In CommandLine	4	9
`GrantedAccess`	`eq`	`0x1fffff` sigmaCredential Dumping Activity By Python Based Tool sigmaCredential Dumping Attempt Via WerFault sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS dump via process access kustoDumping LSASS Process Into a File	5	9
`event.category`	`eq`	`process` elasticPotential Invoke-Mimikatz PowerShell Script elasticPotential LSASS Memory Dump via PssCaptureSnapShot elasticPotential PowerShell HackTool Script by Function Names elasticPowerShell Kerberos Ticket Dump elasticPowerShell MiniDump Script	5	128
`CallTrace`	`contains`	`dbgcore.dll` sigmaPotential Credential Dumping Activity Via LSASS sigmaSuspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs splunkAccess LSASS Memory for Dump Creation kustoDumping LSASS Process Into a File	4	4
`CallTrace`	`contains`	`dbghelp.dll` sigmaPotential Credential Dumping Activity Via LSASS sigmaSuspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs splunkAccess LSASS Memory for Dump Creation kustoDumping LSASS Process Into a File	4	4
`GrantedAccess`	`ends_with`	`0x14c2` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`10` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaUncommon GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`18` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`1a` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`30` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`38` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`3a` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`50` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`58` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`5a` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`70` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`78` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4
`GrantedAccess`	`ends_with`	`7a` sigmaLSASS Access From Potentially White-Listed Processes sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaLSASS Memory Access by Tool With Dump Keyword In Name sigmaPotentially Suspicious GrantedAccess Flags On LSASS	4	4

Exclusions (405 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Field	Kind	Value	Rules excluding
`SubjectUserName`	`ends_with`	`$` sigmaLSASS Access From Non System Account sigmaLSASS credential dump with LSASSY (kernel access) sigmaLSASS process dump by a non system account sigmaSAM database user credentials dump with Mimikatz	4
`Image`	`ends_with`	`\aurora-agent-64.exe` sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaPotentially Suspicious GrantedAccess Flags On LSASS sigmaUncommon GrantedAccess Flags On LSASS	3
`Image`	`ends_with`	`\aurora-agent.exe` sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaPotentially Suspicious GrantedAccess Flags On LSASS sigmaUncommon GrantedAccess Flags On LSASS	3
`Image`	`ends_with`	`\mbaminstallerservice.exe` sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaPotentially Suspicious GrantedAccess Flags On LSASS sigmaUncommon GrantedAccess Flags On LSASS	3
`Image`	`ends_with`	`\thor.exe` sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaPotentially Suspicious GrantedAccess Flags On LSASS sigmaUncommon GrantedAccess Flags On LSASS	3
`Image`	`ends_with`	`\thor64.exe` sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaPotentially Suspicious GrantedAccess Flags On LSASS sigmaUncommon GrantedAccess Flags On LSASS	3
`Image`	`ends_with`	`\dropboxupdate.exe` sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaUncommon GrantedAccess Flags On LSASS	2
`process_name`	`eq`	`c:\windows\system32\wbem\wmiprvse.exe` sigmaLSASS Access Detected via Attack Surface Reduction sigmaLSASS Access From Non System Account elasticLSASS Memory Dump Handle Access	3
`GrantedAccess`	`eq`	`0x1410` sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaUncommon GrantedAccess Flags On LSASS	2
`GrantedAccess`	`eq`	`0x40` sigmaPotentially Suspicious GrantedAccess Flags On LSASS elasticSuspicious Lsass Process Access	2
`GrantedAccess`	`eq`	`0x410` sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaUncommon GrantedAccess Flags On LSASS	2
`Image`	`contains`	`\appdata\local\` sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaUncommon GrantedAccess Flags On LSASS	2
`Image`	`contains`	`\appdata\local\temp\` sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaUncommon GrantedAccess Flags On LSASS	2
`Image`	`contains`	`\steamlibrary\steamapps\` sigmaPotentially Suspicious GrantedAccess Flags On LSASS sigmaUncommon GrantedAccess Flags On LSASS	2
`Image`	`contains`	`\vs_bootstrapper_` sigmaLSASS Access From Program In Potentially Suspicious Folder sigmaUncommon GrantedAccess Flags On LSASS	2

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

OS Credential Dumping: LSASS Memory `T1003.001`

Events covered

Authoring guide

Fields filtered most (85 distinct)

Top indicator values (1419 distinct)

Exclusions (405 distinct)

Rules under this technique

Sigma 90 rules

Elastic 23 rules

Splunk 26 rules

Kusto 8 rules

YARA-L 18 rules

Panther 3 rules

Keyboard shortcuts

Search operators

OS Credential Dumping: LSASS Memory T1003.001

Events covered

Authoring guide

Fields filtered most (85 distinct)

Top indicator values (1419 distinct)

Exclusions (405 distinct)

Rules under this technique

Sigma 90 rules

Elastic 23 rules

Splunk 26 rules

Kusto 8 rules

YARA-L 18 rules

Panther 3 rules

OS Credential Dumping: LSASS Memory `T1003.001`