LSASS Credential Dumping Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•31

Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory with specific access rights (0x705) and an object type of 'SAM_DOMAIN'. This activity is indicative of tools or techniques used to dump credentials from LSASS, a common method for adversaries to obtain user credentials.