Detection rules › By event
Microsoft-Windows-Sysmon Event ID 10
Sigma (30)
- CMSTP Execution Process Access
- Credential Dumping Activity By Python Based Tool
- Credential Dumping Attempt Via Svchost
- Credential Dumping Attempt Via WerFault
- Function Call From Undocumented COM Interface EditionUpgradeManager
- HackTool - CobaltStrike BOF Injection Pattern
- HackTool - Generic Process Access
- HackTool - HandleKatz Duplicating LSASS Handle
- HackTool - LittleCorporal Generated Maldoc Injection
- HackTool - SysmonEnte Execution
- LSASS Access From Potentially White-Listed Processes
- LSASS Access From Program In Potentially Suspicious Folder
- LSASS dump via process access
- LSASS Memory Access by Tool With Dump Keyword In Name
- Lsass Memory Dump via Comsvcs DLL
- Malware Shellcode in Verclsid Target Process
- Potential Credential Dumping Activity Via LSASS
- Potential Credential Dumping Attempt Via PowerShell
- Potential Direct Syscall of NtOpenProcess
- Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access
- Potential Shellcode Injection
- Potentially Suspicious GrantedAccess Flags On LSASS
- Remote LSASS Process Access Through Windows Remote Management
- Suspicious LSASS Access Via MalSecLogon
- Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze
- Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
- Suspicious Svchost Process Access
- UAC Bypass Using WOW64 Logger DLL Hijack
- Uncommon GrantedAccess Flags On LSASS
- Uncommon Process Access Rights For Target Image
Elastic (7)
- Potential Credential Access via DuplicateHandle in LSASS
- Potential Credential Access via LSASS Memory Dump
- Potential LSASS Memory Dump via PssCaptureSnapShot
- Suspicious LSASS Access via MalSecLogon
- Suspicious Lsass Process Access
- Suspicious Process Access via Direct System Call
- Suspicious Process Creation CallTrace
Splunk (15)
- Access LSASS Memory for Dump Creation
- Detect Credential Dumping through LSASS access
- Mimikatz (Sysmon)
- Rubeus Kerberos Ticket Exports Through Winlogon Access
- Spoolsv Suspicious Process Access
- Windows Access Token Manipulation Winlogon Duplicate Token Handle
- Windows Access Token Winlogon Duplicate Handle In Uncommon Path
- Windows Handle Duplication in Known UAC-Bypass Binaries
- Windows Hunting System Account Targeting Lsass
- Windows Non-System Account Targeting Lsass
- Windows Possible Credential Dumping
- Windows Process Injection into Commonly Abused Processes
- Windows Process Injection into Notepad
- Windows Terminating Lsass Process
- Windows WMI Impersonate Token