<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-credential-dumping
description: >-
  Detect credential dumping techniques targeting LSASS, SAM, NTDS.dit,
  and credential stores. Covers Mimikatz, comsvcs.dll, Rubeus, DCSync,
  and kerberoasting with Sigma rules, Sysmon telemetry, and SIEM queries.
domain: cybersecurity
subdomain: blue-team
tags:
  - credential-dumping
  - mimikatz
  - lsass
  - kerberoasting
  - detection-engineering
  - t1003
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003"]
---

# Detecting Credential Dumping

## Overview

Credential dumping (MITRE T1003) is a critical adversary technique that extracts
authentication material from memory, registry, or domain controllers. Detecting
it requires monitoring LSASS access, SAM registry reads, DCSync replication,
and Kerberos ticket operations across endpoint and network telemetry.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Sysmon (EID 1, 7, 10) | Process access to lsass.exe |
| Windows Security Log | EID 4624, 4648, 4662, 4769 |
| Credential Guard (mitigation) | Virtualization-based LSASS protection |
| EDR with memory protection | Detect process injection into LSASS |

## Key Concepts

### Credential Dumping Sub-Techniques

| Sub-Technique | ATT&CK ID | Method | Detection Source |
|---|---|---|---|
| LSASS Memory | T1003.001 | Mimikatz, procdump, comsvcs | Sysmon EID 10 |
| SAM Registry | T1003.002 | reg save, secretsdump | Sysmon EID 1, EID 4656 |
| NTDS.dit | T1003.003 | ntdsutil, vssadmin shadow copy | Sysmon EID 1, EID 4688 |
| LSA Secrets | T1003.004 | reg query HKLM\SECURITY | Registry access audit |
| DCSync | T1003.006 | Replicating directory changes | EID 4662 (DS-Replication) |
| Kerberoasting | T1558.003 | TGS request for SPN | EID 4769 (RC4 encryption) |

### LSASS Access Detection (Sigma)

```yaml
title: Suspicious LSASS Process Access
id: b5e7f3a1-9c2d-4e8f-a6b4-3d1c5e7f9a2b
status: experimental
description: Detects process access to LSASS indicative of credential dumping
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1038'
      - '0x1fffff'
      - '0x40'
  filter_system:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\csrss.exe'
      - '\svchost.exe'
      - '\lsass.exe'
    SourceImage|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Program Files\Windows Defender\'
  condition: selection and not filter_system
falsepositives:
  - Endpoint protection products scanning LSASS
  - Windows Credential Guard operations
level: critical
tags:
  - attack.credential_access
  - attack.t1003.001
```

### Comsvcs.dll LSASS Dump (Sigma)

```yaml
title: LSASS Dump via Comsvcs.dll
id: c6d8e4f2-3a5b-4c7d-9e1f-8b2a6d4c5e3f
status: experimental
description: Detects LSASS memory dump using comsvcs.dll MiniDump export
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - 'comsvcs'
      - 'MiniDump'
  alt_selection:
    CommandLine|contains|all:
      - 'rundll32'
      - '#24'
  condition: selection or alt_selection
falsepositives:
  - None known
level: critical
tags:
  - attack.credential_access
  - attack.t1003.001
```

### DCSync Detection (KQL)

```kql
SecurityEvent
| where EventID == 4662
| where OperationType == "Object Access"
| where Properties has_any (
    "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2",  // DS-Replication-Get-Changes
    "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"   // DS-Replication-Get-Changes-All
)
| where SubjectUserName !endswith "$"  // Exclude machine accounts
| project TimeGenerated, SubjectUserName, SubjectDomainName, ObjectName
```

### Kerberoasting Detection (SPL)

```spl
index=windows EventCode=4769 Ticket_Encryption_Type=0x17 Service_Name!="krbtgt"
| where NOT match(Service_Name, "\$")
| stats count by Service_Name, Client_Address, Account_Name
| where count > 5
| sort -count
```

### SAM/NTDS Extraction Detection

```yaml
title: SAM Registry Hive Extraction
id: d7e9f5a3-4b6c-5d8e-0f2a-9c3b7e1d6f4a
status: experimental
description: Detects SAM registry hive save for offline credential extraction
logsource:
  category: process_creation
  product: windows
detection:
  selection_reg:
    CommandLine|contains|all:
      - 'reg'
      - 'save'
    CommandLine|contains:
      - 'hklm\sam'
      - 'hklm\security'
      - 'hklm\system'
  selection_ntds:
    CommandLine|contains|all:
      - 'ntdsutil'
      - 'ac i ntds'
  condition: selection_reg or selection_ntds
falsepositives:
  - Authorized backup operations
level: critical
tags:
  - attack.credential_access
  - attack.t1003.002
  - attack.t1003.003
```

## Workflow

1. **Deploy** — Enable Sysmon EID 10 for lsass.exe access monitoring
2. **Baseline** — Identify legitimate LSASS access patterns (AV, EDR)
3. **Detect** — Deploy Sigma rules for each sub-technique
4. **Alert** — Critical severity for any unfiltered LSASS access
5. **Investigate** — Trace parent process chain to identify initial access
6. **Contain** — Isolate host, force password reset for exposed accounts
7. **Harden** — Enable Credential Guard, restrict debug privileges

## Verification

| Check | Method |
|---|---|
| Sysmon EID 10 enabled | Sysmon config includes ProcessAccess for lsass |
| Sigma rules deployed | `sigma check` on all credential rules passes |
| DCSync detection active | EID 4662 with replication GUIDs monitored |
| Kerberoasting detection | EID 4769 with RC4 encryption type alerting |
| Credential Guard | `Get-CimInstance -ClassName Win32_DeviceGuard` |

## References

- [MITRE T1003 — OS Credential Dumping](https://attack.mitre.org/techniques/T1003/)
- [Mimikatz Wiki](https://github.com/gentilkiwi/mimikatz/wiki)
- [LSASS Protection Guide](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection)
