SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Identity, authentication and credential attacks

LSASS memory dumping

LSASS memory read for plaintext passwords, hashes and Kerberos keys

categoryIdentity, authentication and credential attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Example: Mimikatz

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1003.001 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003.001 -Tool atomic -RunId run-2026-10-14-003 -Command 'Invoke-AtomicTest T1003.001 -TestGuids dea6c349-f1c6-44f3-87a1-1ed33a59a607 -TimeoutSeconds 120'
ATT&CK T1003.001 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003.001 -Tool atomic -RunId run-2026-10-14-007 -Command 'Invoke-AtomicTest T1003.001 -TestGuids dea6c349-f1c6-44f3-87a1-1ed33a59a607 -TimeoutSeconds 120'
ATT&CK T1003.001 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003.001 -Tool atomic -RunId run-2026-10-16-009 -Command 'Invoke-AtomicTest T1003.001 -TestGuids dea6c349-f1c6-44f3-87a1-1ed33a59a607 -TimeoutSeconds 120'

+ 5 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-18 · detected in 26s

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1Powershell script compiling code using CSC.exe, possible malware drop
Sysmon · EID 10LSASS credential dumping: process opened lsass.exe with a dumper access mask (VM_READ / PROCESS_ALL_ACCESS)
Sysmon · EID 11Executable file dropped in folder commonly used by malware
PowerShell · EID 4104Powershell executing process discovery
Security · EID 4624Non network or service local logon.
Security · EID 4634Non service account logged off.
Security · EID 4672Special privileges assigned to new logon.
Event · EID 4673Failed attempt to perform a privileged operation
… and 1 more event type(s)

Detection that fired

  • ✓ Wazuh 100204 (level 13) lab rule — LSASS credential dumping: process opened lsass.exe with a dumper access mask (VM_READ / PROCESS_ALL_ACCESS)

Plus 8 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~83963 incidental alerts/hour — tune against this.

detected windows · 2026-10-18

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1Powershell script compiling code using CSC.exe, possible malware drop
Sysmon · EID 10Lsass process was accessed by C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe with read permissions, possible credential dump
Sysmon · EID 11Executable file dropped in folder commonly used by malware
PowerShell · EID 4104Powershell executing process discovery
Security · EID 4624Non network or service local logon.
Security · EID 4634Non service account logged off.
Security · EID 4672Special privileges assigned to new logon.
Event · EID 4673Failed attempt to perform a privileged operation
… and 1 more event type(s)

Plus 9 stock Wazuh/Sysmon rule(s) in the window.

⚠ Gap: rule 100205 was expected but did not fire in this run — the telemetry above is the hunt surface, not a solved detection.

Background noise in the window: ~56622 incidental alerts/hour — tune against this.

Classification

25 values: 13 reviewed, 4 lab-measured, 7 imported, 1 derived. What do these mean?

Exploitability

Attack vectorCredential attacks
Reach (CVSS)Local
Attack complexityLow
Privileges requiredHigh
User interactionNone
Attacker skill requiredLow
Resources requiredLow
Likelihood / prevalenceHigh
MaturityCommoditized

Impact & scope

SeverityHigh
ImpactConfidentiality
PlatformWindows
EnvironmentOn-premises
Target asset classEndpointIdentity
Kill-chain phase (tactic)Credential Access

Detection & telemetry

Detectability (measured in our lab)Medium
Detectability (public detection content)High
Noise levelHigh
TestabilityAtomic Red Team testCustom lab test
Data sources (ATT&CK data components)File CreationProcess AccessProcess CreationWindows Registry Key Modification

Detection & response

Mitigated by 19

  • M1017 attack-mitigation
  • M1025 attack-mitigation
  • M1026 attack-mitigation
  • M1027 attack-mitigation
  • M1028 attack-mitigation
  • M1040 attack-mitigation
  • M1043 attack-mitigation
  • D3-ABPI d3fend
  • D3-HBPI d3fend
  • D3-HR d3fend
  • D3-HS d3fend
  • D3-KBPI d3fend
  • D3-PLA d3fend
  • D3-PS d3fend
  • D3-PSA d3fend
  • D3-PSMD d3fend
  • D3-PT d3fend
  • D3-SCF d3fend
  • D3-WSAM d3fend

Detected by 82

  • DET0363 attack-detection-strategy
  • 03e2746e-2b31-42f1-ab7a-eb39365b2422 sigma
  • 03f4ca17-de95-428d-a75a-4ee78b047256 sigma
  • 06d71506-7beb-4f22-8888-e2e5e2ca7fd8 sigma
  • 0b4ae027-2a2d-4b93-8c7e-962caaba5b2a sigma
  • 0e277796-5f23-4e49-a490-483131d4f6e1 sigma
  • 0f920ebe-7aea-4c54-b202-9aa0c609cfe5 sigma
  • 129966c9-de17-4334-a123-8b58172e664d sigma
  • 1a1ed54a-2ba4-4221-94d5-01dee560d71e sigma
  • 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2 sigma
  • 23ceaf5c-b6f1-4a32-8559-f2ff734be516 sigma
  • 2704ab9e-afe2-4854-a3b1-0c0706d03578 sigma
  • 2e65275c-8288-4ab4-aeb7-6274f58b6b20 sigma
  • 2e69f167-47b5-4ae7-a390-47764529eff5 sigma
  • 2f869d59-7f6a-4931-992c-cce556ff2d53 sigma
  • 33efc23c-6ea2-4503-8cfe-bdf82ce8f719 sigma
  • 36d88494-1d43-4dc0-b3fa-35c8fea0ca9d sigma
  • 472159c5-31b9-4f56-b794-b766faa8b0a7 sigma
  • 4976aa50-8f41-45c6-8b15-ab3fc10e79ed sigma
  • 4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76 sigma
  • 4be8b654-0c01-4c9d-a10c-6b28467fc651 sigma
  • 4c0aaedc-154c-4427-ada0-d80ef9c9deb6 sigma
  • 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48 sigma
  • 55e29995-75e7-451a-bef0-6225e2f13597 sigma
  • 589ac73f-8e12-409c-964e-31a2f5775ae2 sigma
  • 5afee48e-67dd-4e03-a783-f74259dcf998 sigma
  • 5ef9853e-4d0e-4a70-846f-a9ca37d876da sigma
  • 646ea171-dded-4578-8a4d-65e9822892e3 sigma
  • 66e563f9-1cbd-4a22-a957-d8b7c0f44372 sigma
  • 678dfc63-fefb-47a5-a04c-26bcf8cc9f65 sigma
  • 6902955a-01b7-432c-b32a-6f5f81d8f625 sigma
  • 69ca12af-119d-44ed-b50f-a47af0ebc364 sigma
  • 736ffa74-5f6f-44ca-94ef-1c0df4f51d2a sigma
  • 78cc2dd2-7d20-4d32-93ff-057084c38b93 sigma
  • 79aeeb41-8156-4fac-a0cd-076495ab82a1 sigma
  • 79b06761-465f-4f88-9ef2-150e24d3d737 sigma
  • 7aa7009a-28b9-4344-8c1f-159489a390df sigma
  • 84c174ab-d3ef-481f-9c86-a50d0b8e3edb sigma
  • 857c8db3-c89b-42fb-882b-f681c7cf4da2 sigma
  • 8a1b2c3d-4e5f-6789-abcd-ef1234567890 sigma
  • … and 42 more in the database

Tested by 17

  • 0be2230c-9ab3-4ac2-8826-3199b9a0ebf8 atomic
  • 2536dee2-12fb-459a-8c37-971844fa73be atomic
  • 453acf13-1dbd-47d7-b28a-172ce9228023 atomic
  • 47a539d1-61b9-4364-bf49-a68bc2a95ef0 atomic
  • 6502c8f0-b775-4dbd-9193-1298f56b6781 atomic
  • 66fb0bc1-3c3f-47e9-a298-550ecfefacbc atomic
  • 7ae7102c-a099-45c8-b985-4c7a2d05790d atomic
  • 7cede33f-0acd-44ef-9774-15511300b24b atomic
  • 86fc3f40-237f-4701-b155-81c01c48d697 atomic
  • 9d0072c8-7cca-45c4-bd14-f852cfa35cf0 atomic
  • c37bc535-5c62-4195-9cc3-0517673171d8 atomic
  • dddd4aca-bbed-46f0-984d-e4c5971c51ea atomic
  • dea6c349-f1c6-44f3-87a1-1ed33a59a607 atomic
  • eb5adf16-b601-4926-bca7-dad22adffb37 atomic
  • lab-custom-lsass-access-probe-win other
  • lab-custom-lsass-access-probe-win-dup other
  • lab-custom-lsass-access-probe-win-overlap other

Attack relationships

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

RunOutcomeToolPlatformRan at
run-2026-10-14-003partially-detectedatomicwindows2026-10-14
run-2026-10-14-007partially-detectedatomicwindows2026-10-14
run-2026-10-16-009partially-detectedatomicwindows2026-10-16
run-2026-10-18-001detectedotherwindows2026-10-18
run-2026-10-18-002detectedotherwindows2026-10-18
run-2026-10-18-004detectedotherwindows2026-10-18
  • run-2026-10-14-003 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=14). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=12 max_level=15 dwell_s=90
  • run-2026-10-14-007 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=14). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=12 max_level=15 dwell_s=90
  • run-2026-10-16-009 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=14). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=12 max_level=15 dwell_s=90
  • run-2026-10-18-001 — E2 probe for CANDIDATE Wazuh rule 100204 (LSASS credential dumping, EID10). PENDING G1 (detonation approval) and G2 (rule deploy) -- do not run until both are granted and 100204 is live on the manager. Signature-only: one OpenProcess(lsass, 0x1410) + immediate CloseHandle; no ReadProcessMemory, no dump, no credential material touched. Needs the win-victim Sysmon ProcessAccess include for lsass (sysmonconfig-lab.xml lab-eid10-lsass-and-browser). Hand-written; coexists with the t1003.001-atomic-batch entry (Task Manager dump), which is the realistic-tool arm.; expected=1 incidental=1433 max_level=15 dwell_s=90
  • run-2026-10-18-002 — E2 probe for CANDIDATE Wazuh rule 100205 (lsass handle-duplication access, lower level). Same signature-only probe as t1003.001-custom-windows-lsass-access with mask 0x40. PENDING G1 + G2 as above.; expected=1 incidental=1447 max_level=15 dwell_s=90
  • run-2026-10-18-004 — E2 overlap proof. 0x1010 is the ONE mask that BOTH 100204 and the stock ruleset's 92900 (L12, unanchored grantedAccess (0x1010|0x40)) match; 100204 is L13 so it must win this event deterministically, with no load-order tie-break. Same signature-only probe as t1003.001-custom-windows-lsass-access, mask 0x1010. 0x40 (PROCESS_DUP_HANDLE) is intentionally left to 92900 -- former rule 100205 retired 2026-10-18 as permanently shadowed by it.; expected=1 incidental=1516 max_level=15

Framework references

Evidence & sources

  • ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 333 of Cyber-Attack-Taxonomy.md
  • ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 79 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0003 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-003 (partially-detected) for T1003.001: no alert matched the expected technique
  • ev-0004 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-007 (partially-detected) for T1003.001: no alert matched the expected technique
  • ev-0005 (Phase 4 detection lab - detonation runs 2026-10-16) — Lab detonation run-2026-10-16-009 (partially-detected) for T1003.001: no alert matched the expected technique
  • ev-0006 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-001 (detected): Wazuh rule(s) 100204 fired on T1003.001 within the detonation window
    LSASS credential dumping: process opened lsass.exe with a dumper access mask (VM_READ / PROCESS_ALL_ACCESS)
  • ev-0007 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-002 (detected): Wazuh rule(s) 92900 fired on T1003.001 within the detonation window
    Lsass process was accessed by C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe with read permissions, possible credential dump
  • ev-0008 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-004 (detected): Wazuh rule(s) 100204 fired on T1003.001 within the detonation window
    LSASS credential dumping: process opened lsass.exe with a dumper access mask (VM_READ / PROCESS_ALL_ACCESS)