Skip to main content
Tier One
Critical

Credential dumping tool executed against LSASS

A-1045

00:00time on this alert, target 5 minutes

Back to queue

Alert details

Source
EDR
Detection rule
EDR-CRED-DUMP-001
Affected user
a.brennan
Affected host
SRV-ERP-02
Source IP
—
First seen
2026-07-24T13:55:00Z

Why this fired, in plain English

A program opened the Windows process that holds passwords in memory and copied it to a file.

Suggested playbook

Malware detection on an endpoint

  1. 1. Read the action field first: blocked/quarantined changes urgency dramatically versus alert_only.
  2. 2. Identify the process path. AppData, Temp and Users\Public are common malware locations.
  3. 3. Check the parent process — Office apps spawning shells is abnormal.
  4. 4. Look up the file hash for a verdict and first-seen date.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 4 events.

  1. Guided hint: this line matters

    ts=2026-07-24T13:52:31Z host=SRV-ERP-02 EventID=4688 process_name="C:\\Windows\\Temp\\svch0st.exe" parent_process="powershell.exe" user="a.brennan" cmdline="svch0st.exe -ma lsass.exe C:\\Windows\\Temp\\out.dmp"

    svch0st.exe with a zero is a typo-squat of the real svchost.exe, and it is running from a temp folder.

  2. Guided hint: this line matters

    ts=2026-07-24T13:52:33Z host=SRV-ERP-02 sensor=edr event=process_access target="lsass.exe" access_mask=0x1010 result=allowed sha256=7d4f3ac91e0b5b2fa9c3d70e18b47c2a55f9de0731cc84f4e2ab6d19c507ae33

    LSASS is where Windows keeps signed-in users' credentials. Reading it is the classic way to steal passwords.

  3. ts=2026-07-24T13:53:02Z host=SRV-ERP-02 sensor=edr event=file_write path="C:\\Windows\\Temp\\out.dmp" size_bytes=118293504

  4. Guided hint: this line matters

    ts=2026-07-24T13:55:00Z host=SRV-ERP-02 sensor=edr event=detection rule="EDR-CRED-DUMP-001" action=alert_only

    action=alert_only means the tool warned but did not block. Nothing has stopped this yet.

Related events

The order things happened in.

  1. 13:52Z

    Renamed dumper launched from PowerShell

  2. 13:52Z

    LSASS memory accessed

  3. 13:53Z

    113 MB dump file written

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.