How do you detect LSASS credential dumping before ransomware?

Detect LSASS dumping at the access layer and the tooling layer. Alert on Sysmon Event 10 where a non-system process opens lsass.exe with memory-read access masks (for example 0x1010, 0x1410, 0x1fffff), after allowlisting EDR and backup agents. Add process-creation rules for rundll32 with comsvcs MiniDump, ProcDump targeting lsass, and new .dmp files in temp or public folders. Treat a confirmed dump as an incident and reset the exposed accounts, because it normally precedes domain-wide deployment by hours or days.

Detecting LSASS Credential Dumping as a Ransomware Precursor

Almost every hands-on-keyboard ransomware intrusion dumps credentials from LSASS to reach domain admin. That step happens hours to days before encryption, and it is loud when you look at the right telemetry: a handle with read-memory rights to lsass.exe, a living-off-the-land MiniDump call, or a fresh dump file on disk.

Signals at a Glance

Signal	Where	ATT&CK
Process access to lsass.exe with memory-read access masks	Sysmon 10, EDR	T1003.001
rundll32 loading comsvcs.dll with MiniDump	Sysmon 1, 4688	T1003.001
ProcDump or similar with lsass as the target	Sysmon 1, EDR	T1003.001
New .dmp file in a temp or public folder	Sysmon 11, EDR	T1003.001
Credential Guard or RunAsPPL tampering	Registry, Sysmon 13	T1562.001

Handle Access to LSASS

The most robust signal is the access itself, because it holds regardless of which tool the operator brings. Alert on non-system processes opening lsass.exe with the access masks that allow reading memory:

index=sysmon EventCode=10 TargetImage="*lsass.exe"
    GrantedAccess IN ("0x1010","0x1410","0x1438","0x143a","0x1fffff","0x1f3fff")
| search NOT SourceImage IN ("*MsMpEng.exe","*csrss.exe","*wininit.exe","*services.exe","*svchost.exe","*taskmgr.exe")
| stats count values(GrantedAccess) as masks by Computer SourceImage User
| sort - count
`comment("tune/validate: allowlist your EDR and backup agents by full path and signer")`

Living-off-the-Land Dumps

Operators avoid dropping Mimikatz by using binaries already on the host. The comsvcs.dll export called with an ordinal or MiniDump name, and signed Sysinternals tools, are common. A Sigma starting point:

title: LSASS Dump via comsvcs or ProcDump
logsource:
  category: process_creation
  product: windows
detection:
  selection_comsvcs:
    CommandLine|contains|all:
      - 'comsvcs'
      - 'MiniDump'
  selection_ordinal:
    CommandLine|contains|all:
      - 'comsvcs'
      - '#24'
  selection_procdump:
    Image|endswith:
      - '\procdump.exe'
      - '\procdump64.exe'
    CommandLine|contains: 'lsass'
  condition: 1 of selection_*
level: high
# tune/validate: confirm no sanctioned crash-dump tooling targets lsass

Enable LSA protection (RunAsPPL) and Credential Guard where supported; then alert on any attempt to change them.
Treat a confirmed dump as an incident, not an alert: reset the exposed accounts, starting with privileged and service accounts used on that host.
Join the dump event to the logons that follow. Use of the dumped account on a second host within minutes is the fastest confirmation.

Vetted sources

SigmaHQ credential-access rules, Elastic LSASS memory access detections and Splunk ESCU LSASS analytics cover this ground well, and MITRE CAR documents access-pattern analytics. Access masks and EDR allowlists differ per estate, so baseline your own environment before enforcing.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Handle Access to LSASS

Living-off-the-Land Dumps

Build Detections That Fire

Ransomware Precursor Detection

Detection Hub

Mass PsExec Deployment Detection

Ransomware Kill-Chain Correlation