Credential Dumping Detection

This query detects potential credential dumping activities by monitoring process access to LSASS and suspicious memory operations.

CQL · Falcon Next-Gen SIEMCopy query

Loading query…

Credential_Dumping_Detection.yml

T1003.001, T1003.002, T1558.003

ByteRay GmbH

Hunting

Endpoint

Insight

Want this running in your SIEM — with someone on call?

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team