When hunting for credential theft activity in the environment
After compromise indicators suggest attacker has elevated privileges
When EDR alerts fire for LSASS access or suspicious process memory reads
During incident response to determine scope of credential compromise
When auditing LSASS protection controls (Credential Guard, RunAsPPL)
Prerequisites
EDR agent deployed with LSASS access monitoring (CrowdStrike, Defender for Endpoint, SentinelOne)
Sysmon Event ID 10 (ProcessAccess) with LSASS-specific filters
Windows Security Event ID 4656/4663 (Object Access Auditing)
LSASS SACL auditing enabled (Windows 10+)
Registry auditing for SAM hive access
Workflow
Monitor LSASS Process Access: Track all processes opening handles to lsass.exe with suspicious access rights (PROCESS_VM_READ 0x0010, PROCESS_ALL_ACCESS 0x1FFFFF). Non-privileged or unusual processes accessing LSASS are strong indicators.
Detect Credential Dumping Tools: Hunt for known tool signatures -- Mimikatz (sekurlsa::logonpasswords), procdump.exe targeting LSASS, comsvcs.dll MiniDump, and Task Manager creating LSASS…
以下为摘要预览，完整内容请查看 GitHub 原文。
使用 EDR 检测 T1003 凭据转储
适用场景
在环境中搜寻凭据窃取活动时
在失陷指标表明攻击者已获得提升权限之后
当 EDR 针对 LSASS 访问或可疑进程内存读取触发告警时
在事件响应过程中确定凭据失陷的范围时
在审计 LSASS 保护控制（Credential Guard、RunAsPPL）时
先决条件
已部署启用 LSASS 访问监控的 EDR 代理（CrowdStrike、Defender for Endpoint、SentinelOne）
