LSASS Process Memory Dump Creation Via Taskmgr.EXE

Title: LSASS Process Memory Dump Creation Via Taskmgr.EXE
Status: test
Description:Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1003.001/T1003.001.md#L1
Author: Swachchhanda Shrawan Poudel
Date: 2023-10-19
modified:None
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    Image|endswith:
      -':\Windows\system32\taskmgr.exe'
      -':\Windows\SysWOW64\taskmgr.exe'

    TargetFilename|contains|all:
      -'\AppData\Local\Temp\'
      -'\lsass'
      -'.DMP'

  condition:selection
Falsepositives:
  -Rare case of troubleshooting by an administrator or support that has to be investigated regardless
Level: high