skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-t1003-credential-dumping-with-edr

Detect credential dumping against LSASS, SAM, and NTDS.dit using EDR and Sysmon telemetry.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#sysmon#edr#credential dumping#detection engineering#LSASS#mitre t1003
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-t1003-credential-dumping-with-edr
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-t1003-credential-dumping-with-edr
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-t1003-credential-dumping-with-edr
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-t1003-credential-dumping-with-edr

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams struggle to reliably detect MITRE ATT&CK T1003 credential dumping because attackers evade naive access-mask rules, abuse legitimate tools like procdump and comsvcs.dll, and bypass LSASS monitoring entirely via disk-based paths like NTDS.dit extraction and SAM hive exports.

Core Features & Use Cases

  • Multi-Vector Detection Coverage: Provides ready-to-use Splunk, KQL, and Sigma queries covering LSASS memory access (T1003.001), SAM/SECURITY hive exports, NTDS.dit extraction, and DCSync replication abuse (T1003.006).
  • Evasion-Aware Guidance: Documents detection gaps such as GrantedAccess masking, handle cloning via PROCESS_DUP_HANDLE, and PPL/Credential Guard blind spots, with tuning advice to reduce false positives from MsMpEng and WerFault.
  • Use Case: During incident response after an EDR alert fires for suspicious LSASS access, an analyst uses the provided Sysmon Event ID 10 queries and validation steps (Atomic Red Team T1003 tests) to confirm credential theft, scope compromised accounts, and trigger password resets.

Quick Start

Ask the AI to hunt for LSASS credential dumping activity across your Windows fleet using the provided Sysmon Event ID 10 Splunk query and report any suspicious source processes.

Frequently Asked Questions about detecting-t1003-credential-dumping-with-edr

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect LSASS credential dumping with Sysmon?▼

Use Sysmon Event ID 10 (ProcessAccess) filtered on TargetImage ending in lsass.exe with suspicious GrantedAccess masks like 0x1FFFFF, 0x143A, or 0x0040. Exclude known-good source processes such as csrss.exe, MsMpEng.exe, and svchost.exe to reduce false positives.

How to detect Mimikatz and procdump credential dumping on Windows?▼

Hunt Sysmon Event ID 1 command lines for patterns like sekurlsa, procdump with -ma targeting lsass, comsvcs.dll MiniDump, and reg save of SAM or SECURITY hives. These signatures catch common dumping tools even when LSASS access rules are evaded.

What EDR platforms work with these credential dumping detection queries?▼

The queries target CrowdStrike, Microsoft Defender for Endpoint, and SentinelOne telemetry, expressed in Splunk SPL, KQL for Defender, and a Sigma rule. Any SIEM ingesting Sysmon Event ID 10 and Windows Security events can use the SPL and Sigma logic.

Why do LSASS detection rules miss some credential dumping attacks?▼

Rules pinned to access masks like 0x1FFFFF miss tools requesting minimal rights such as 0x1410 or cloning handles via PROCESS_DUP_HANDLE. Disk-based paths like vssadmin shadow copies of NTDS.dit and reg save of SAM bypass LSASS monitoring entirely and require command-line auditing.

How do I validate that credential dumping detections actually fire?▼

Run Atomic Red Team tests for T1003.001 (comsvcs MiniDump, procdump -ma lsass) and T1003.003 in a test environment. Confirm the Sysmon Event ID 10, Event ID 1, and Security Event 4662 searches trigger as expected before relying on them in production.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced
AeonDaveAeonDave
15

lazagne

Extract saved passwords from browsers, mail clients, databases, Git, and WiFi.

Community
Intermediate
blacklanternsecurityblacklanternsecurity
253

pass-the-hash

Authenticate to Active Directory services using stolen NTLM hashes, AES keys, or Kerberos tickets.

Official
Advanced
AeonDaveAeonDave
15

mimikatz

Extract Windows credentials and Kerberos tickets from LSASS memory.

Community
Advanced