Imported from meltedinhex/analyst-ai-pack (skills/hunting-credential-dumping-activity/SKILL.md). Install upstream with npx skills add meltedinhex/analyst-ai-pack --skill hunting-credential-dumping-activity. Copyright stays with the author (Apache-2.0).

Hunting Credential Dumping Activity

When to Use

• You have Sysmon ProcessAccess (Event ID 10) and/or process-creation telemetry and want to detect attempts to read LSASS memory or dump credentials.
• You are investigating post-exploitation credential theft.

Do not use this to dump credentials yourself — it analyzes telemetry of such activity. Legit security tools also touch LSASS; corroborate before alerting.

Prerequisites

• Sysmon EID 10 events (with TargetImage, GrantedAccess, SourceImage) and/or EID 1 process events.

Workflow

Step 1: Hunt LSASS access and dumping patterns

python scripts/analyst.py hunt events.csv

Flags EID 10 events where TargetImage is lsass.exe with high-risk GrantedAccess masks (0x1010, 0x1410, 0x143a, 0x1438), and process events showing comsvcs.dll,MiniDump, procdump ... lsass, rundll32 ... MiniDump, or known tool names.

Step 2: Reduce false positives

De-prioritize known security agents (EDR, AV) as the SourceImage; weight unsigned or unusual source processes.

Step 3: Confirm

Correlate with file writes of .dmp files and subsequent off-host transfer.

Step 4: Operationalize

Write a Sigma rule for LSASS access masks and comsvcs MiniDump.

Validation

• LSASS access flags are based on access mask, not mere access by trusted tools.
• comsvcs/procdump/rundll32 MiniDump patterns are detected from command lines.
• Findings map to ATT&CK T1003.001/.002.

Pitfalls

• Many legitimate tools open LSASS — access mask + source-image context is essential.
• Attackers renaming tools; rely on behavior (mask, MiniDump export) not just names.
• Direct-syscall dumpers that avoid the usual API and reduce telemetry.

References

• See references/api-reference.md for the hunter.
• ATT&CK T1003.001 and Sysmon EID 10 (linked in frontmatter).