LSASS dump file written to disk

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	OS Credential Dumping (T1003)
Severity	Medium

Description

Dumping Lsass.exe (Local Security Authority Subsystem Service) memory to file allows attackers to later extract credentials from the memory dump.

Attacker's Goals

Attackers may try to extract OS credentials from the dumped Lsass.exe file.

Investigative actions

Check the dumping process for more suspicious activity.