Credential Dumping Detection
This query detects potential credential dumping activities by monitoring process access to LSASS and suspicious memory operations.
#event_simpleName=ProcessRollup2
| (CommandLine=/mimikatz|procdump|lsass|sekurlsa/i OR ImageFileName=/\\(mimikatz|procdump|pwdump)\.exe$/i)
| ParentImageFileName!=/\\(powershell|cmd)\.exe$/i
| join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])
| join({#event_simpleName=SyntheticProcessRollup2}, field=[aid, RawProcessId], include=[SHA256HashData], suffix="Parent")
| table([aid, UserName, ImageFileName, CommandLine, ParentImageFileName, SHA256HashData])This query uses CrowdStrike Query Language (CQL) to detect credential dumping activities:
-
Process Monitoring:
#event_simpleName=ProcessRollup2- Monitors process execution events across endpoints -
Suspicious Indicators:
(CommandLine=/mimikatz|procdump|lsass|sekurlsa/i OR ImageFileName=/\\(mimikatz|procdump|pwdump)\.exe$/i)- Detects known credential dumping tools and LSASS access patterns -
Parent Process Filter:
ParentImageFileName!=/\\(powershell|cmd)\.exe$/i- Excludes common legitimate parent processes to reduce noise -
User Context:
join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])- Adds user account information for attribution -
Process Hash:
join({#event_simpleName=SyntheticProcessRollup2}, field=[aid, RawProcessId], include=[SHA256HashData], suffix="Parent")- Includes file hash for threat intelligence correlation -
Output:
table([aid, UserName, ImageFileName, CommandLine, ParentImageFileName, SHA256HashData])- Displays process details, user context, and file hash information
