LSASS Process Memory Dump Creation Via Taskmgr.EXE

Status: test
Severity: high
Log source: category file_event, product windows
Author: Swachchhanda Shrawan Poudel
Source: github.com/SigmaHQ/sigma

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.

Known false positives

Rare case of troubleshooting by an administrator or support that has to be investigated regardless

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: LSASS Process Memory Dump Creation Via Taskmgr.EXE
id: 69ca12af-119d-44ed-b50f-a47af0ebc364
status: test
description: Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.
author: Swachchhanda Shrawan Poudel
date: 2023-10-19
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1003.001/T1003.001.md#L1
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith:
            - ':\Windows\system32\taskmgr.exe'
            - ':\Windows\SysWOW64\taskmgr.exe'
        TargetFilename|contains|all:
            - '\AppData\Local\Temp\'
            - '\lsass'
            - '.DMP'
    condition: selection
falsepositives:
    - Rare case of troubleshooting by an administrator or support that has to be investigated regardless
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump/info.yml

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith:
        - ':\Windows\system32\taskmgr.exe'
        - ':\Windows\SysWOW64\taskmgr.exe'
    TargetFilename|contains|all:
        - '\AppData\Local\Temp\'
        - '\lsass'
        - '.DMP'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`:\Windows\SysWOW64\taskmgr.exe` `:\Windows\system32\taskmgr.exe`	`field:"Image" kind:ends_with`
`TargetFilename`	match	`.DMP` corpus 3 (sigma 3) `\AppData\Local\Temp\` corpus 8 (sigma 8) `\lsass` corpus 3 (sigma 3)	`field:"TargetFilename" kind:match`