T1003-lsass-memory-dump.toml

[analytic.metadata]
categories = ["detect"]
confidence = "high"
contributors = ["Tony Lambert"]
created_date = "01/07/2019"
description = "Detect creation of dump files containing the memory space of lsass.exe, which contains sensitive credentials."
id = "210b4ea4-12fc-11e9-8d76-4d6bb837cda4"
name = "LSASS Memory Dumping"
os = ["windows"]
tags = ["atomicblue"]
tactics = ["Credential Access"]
techniques = ["T1003"]
updated_date = "01/07/2019"

[analytic]
query = '''
file where file_name == "lsass*.dmp" and process_name != "werfault.exe"
'''