Credential Dumping Activity By Python Based Tool

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

Detects access to the LSASS process by a Python-based tool, indicated by specific call trace patterns involving Python DLLs and KERNELBASE.dll/ntdll.dll, combined with a broad granted access right (0x1FFFFF). This activity is characteristic of credential dumping tools like LaZagne or Pypykatz.