Credential Dumping Detection
This query detects potential credential dumping activities by monitoring process access to LSASS and suspicious memory operations.
#event_simpleName=ProcessRollup2
| (CommandLine=/mimikatz|procdump|lsass|sekurlsa/i OR ImageFileName=/\\(mimikatz|procdump|pwdump)\.exe$/i)
| ParentImageFileName!=/\\(powershell|cmd)\.exe$/i
| join({#event_simpleName=UserIdentity}, field=[aid, AuthenticationId], include=[UserName], mode=left)
| join({#event_simpleName=SyntheticProcessRollup2 | ParentSHA256HashData := SHA256HashData},
field=[aid, ParentProcessId], key=[aid, TargetProcessId], include=[ParentSHA256HashData], mode=left)
| table([aid, UserName, ImageFileName, CommandLine, ParentImageFileName, SHA256HashData, ParentSHA256HashData])This query uses CrowdStrike Query Language (CQL) to detect credential dumping activities:
-
Process Monitoring:
#event_simpleName=ProcessRollup2- Monitors process execution events across endpoints -
Suspicious Indicators:
(CommandLine=/mimikatz|procdump|lsass|sekurlsa/i OR ImageFileName=/\\(mimikatz|procdump|pwdump)\.exe$/i)- Detects known credential dumping tools and LSASS access patterns -
Parent Process Filter:
ParentImageFileName!=/\\(powershell|cmd)\.exe$/i- Excludes common legitimate parent processes to reduce noise -
User Context:
join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])- Adds user account information for attribution -
Process Hash:
join({#event_simpleName=SyntheticProcessRollup2}, field=[aid, RawProcessId], include=[SHA256HashData], suffix="Parent")- Includes file hash for threat intelligence correlation -
Output:
table([aid, UserName, ImageFileName, CommandLine, ParentImageFileName, SHA256HashData])- Displays process details, user context, and file hash information
