Credential Dumping Indicators | Detection Rule Friday

Your LSASS process just got accessed — and you missed it.

Detection Rule Friday | DFIR Media

• Attackers dump credentials from memory to move laterally across your network.
• Watch for tool names in command lines: mimikatz, rubeus, SharpKatz, nanodump.
• Rundll32 calling comsvcs.dll MiniDump? That's targeting LSASS memory directly.
• Procdump dash m a lsass.exe is another red flag for credential theft.
• Hunt with Sysmon Event ID 1 for command lines and ID 10 for LSASS access.
• This is MITRE T1003 — OS Credential Dumping. Build your detections now.

AI-generated narration | DFIR Media

Видео Credential Dumping Indicators | Detection Rule Friday канала DFIR Lab