LSASS Dump Tool Writing to Suspicious Directory
This hunt identifies potential credential dumping activity by detecting known dump tools such as procdump.exe, rundll32.exe, and taskmgr.exe creating memory dump files (.dmp) in suspicious or attacker-preferred directories. Adversaries often store LSASS dumps in locations like: - Temp directories - ProgramData - Public folders These paths are commonly used because they are writable, less monitored, and blend in with normal system activity. The presence of dump files in these locations, especially when created by known dumping tools, it is a strong indicator of malicious credential access attempts.
Cortex XDR
