Skip to content
OpenSmartRoute
Skillv1.0.0

hunting-credential-dumping-activity

Hunts for credential dumping by detecting LSASS process access with suspicious access masks, known dumping tool signatures, and comsvcs.exe MiniDump abuse in Sysmon Event ID 10 and process-creation te

by meltedinhex(0) 0 installs
Free
Sign in to install

Free account. Installing gives you the manifest plus copy-paste snippets.

See reviews

About

Imported from meltedinhex/analyst-ai-pack (skills/hunting-credential-dumping-activity/SKILL.md). Install upstream with npx skills add meltedinhex/analyst-ai-pack --skill hunting-credential-dumping-activity. Copyright stays with the author (Apache-2.0).

Hunting Credential Dumping Activity

When to Use

  • You have Sysmon ProcessAccess (Event ID 10) and/or process-creation telemetry and want to detect attempts to read LSASS memory or dump credentials.
  • You are investigating post-exploitation credential theft.

Do not use this to dump credentials yourself — it analyzes telemetry of such activity. Legit security tools also touch LSASS; corroborate before alerting.

Prerequisites

  • Sysmon EID 10 events (with TargetImage, GrantedAccess, SourceImage) and/or EID 1 process events.

Workflow

Step 1: Hunt LSASS access and dumping patterns

python scripts/analyst.py hunt events.csv

Flags EID 10 events where TargetImage is lsass.exe with high-risk GrantedAccess masks (0x1010, 0x1410, 0x143a, 0x1438), and process events showing comsvcs.dll,MiniDump, procdump ... lsass, rundll32 ... MiniDump, or known tool names.

Step 2: Reduce false positives

De-prioritize known security agents (EDR, AV) as the SourceImage; weight unsigned or unusual source processes.

Step 3: Confirm

Correlate with file writes of .dmp files and subsequent off-host transfer.

Step 4: Operationalize

Write a Sigma rule for LSASS access masks and comsvcs MiniDump.

Validation

  • LSASS access flags are based on access mask, not mere access by trusted tools.
  • comsvcs/procdump/rundll32 MiniDump patterns are detected from command lines.
  • Findings map to ATT&CK T1003.001/.002.

Pitfalls

  • Many legitimate tools open LSASS — access mask + source-image context is essential.
  • Attackers renaming tools; rely on behavior (mask, MiniDump export) not just names.
  • Direct-syscall dumpers that avoid the usual API and reduce telemetry.

References

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml
targets:
  - https://api.opensmartroute.ai/api/v1/registry/meltedinhex-analyst-ai-pack-hunting-credential-dumping-activity/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

meltedinhex-analyst-ai-pack-hunting-credential-dumping-activity.ocm.jsonjson
{
  "ocm": "1",
  "id": "meltedinhex-analyst-ai-pack-hunting-credential-dumping-activity",
  "kind": "skill",
  "name": "hunting-credential-dumping-activity",
  "description": "Hunts for credential dumping by detecting LSASS process access with suspicious access masks, known dumping tool signatures, and comsvcs.exe MiniDump abuse in Sysmon Event ID 10 and process-creation telemetry. Activates for requests to hunt credential dumping, detect LSASS access, or find Mimikatz/comsvcs MiniDump activity.",
  "publisher": "meltedinhex",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "threat-hunting",
      "credential-access",
      "lsass",
      "sysmon",
      "mimikatz",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Hunts for credential dumping by detecting LSASS process access with suspicious access masks, known dumping tool signatures, and comsvcs.exe MiniDump abuse in Sysmon Event ID 10 and process-creation telemetry. Activates for requests to hunt credential dumping, detect LSASS access, or find Mimikatz/comsvcs MiniDump activity."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/meltedinhex/analyst-ai-pack",
      "path": "skills/hunting-credential-dumping-activity/SKILL.md",
      "ref": "da7600a745bb4c3b487ab775b681c04e71e973d4",
      "url": "https://github.com/meltedinhex/analyst-ai-pack/blob/da7600a745bb4c3b487ab775b681c04e71e973d4/skills/hunting-credential-dumping-activity/SKILL.md",
      "key": "meltedinhex/analyst-ai-pack/skills/hunting-credential-dumping-activity/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Hunting Credential Dumping Activity\n\n## When to Use\n\n- You have Sysmon ProcessAccess (Event ID 10) and/or process-creation telemetry and want to detect\n  attempts to read LSASS memory or dump credentials.\n- You are investigating post-exploitation credential theft.\n\n**Do not use** this to dump credentials yourself — it analyzes telemetry of such activity. Legit\nsecurity tools also touch LSASS; corroborate before alerting.\n\n## Prerequisites\n\n- Sysmon EID 10 events (with TargetImage, GrantedAccess, SourceImage) and/or EID 1 process events.\n\n## Workflow\n\n### Step 1: Hunt LSASS access and dumping",
  "cost": {
    "context_tokens": 473
  }
}

Fetch it by URL: GET /api/v1/registry/meltedinhex-analyst-ai-pack-hunting-credential-dumping-activity/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.

hunting-credential-dumping-activity - Skill - OpenSmartRoute