HackTool - HandleKatz LSASS Dumper Execution

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•14

Detects the execution of HandleKatz, a tool designed to dump LSASS memory using cloned handles. The rule identifies the tool by its executable name ('loader.exe'), specific command-line arguments including '--pid:', '--outfile:', and keywords like '.dmp', 'lsass', '.obf', or 'dump', and known IMPHASH values associated with HandleKatz.