dump-lsass-memory-via-openprocess-and-minidumpwritedump

[akshat4703]

Summary

Add a rule to detect attempts to access LSASS and create a memory dump.

Many credential-stealing tools and malware families dump the Local Security Authority Subsystem Service (LSASS) process to extract credentials. This capability can often be identified by combining LSASS process discovery with APIs used to open the process and write a memory dump.

---

Motivation

Dumping LSASS memory is a common credential-access technique used by tools such as Mimikatz and many commodity malware families. Detecting this behavior would improve capa’s ability to identify credential-theft capabilities in analyzed binaries.

---

Proposed Detection Logic

The rule should look for a combination of signals related to LSASS discovery, process access, and dumping behavior.

1. LSASS Process Discovery

• string: lsass.exe
• possible path references to LSASS

2. Process Access

• OpenProcess
• NtOpenProcess
• relevant process access rights such as:
  • PROCESS_VM_READ
  • PROCESS_QUERY_INFORMATION

3. Dump Creation

• MiniDumpWriteDump
• usage of DbgHelp functions associated with process dumping

4. Additional Variant

Some implementations open LSASS via duplicated handles instead of directly calling OpenProcess.
The rule could also account for flows involving:

• DuplicateHandle
• handle inheritance or duplication patterns prior to dump creation

---

False Positive Reduction

To avoid overly broad matches, the rule should require at least two independent signals, such as:

• LSASS discovery + process opening API
• process opening API + MiniDumpWriteDump
• LSASS string + dump API usage

This multi-signal requirement should help reduce false positives in legitimate debugging tools.

---

Example Capability

Credential dumping via LSASS process memory access.

---

Potential Rule Scope

Function scope or file scope depending on feature availability and matching reliability.

---

Notes

This rule focuses on identifying the behavior of accessing and dumping LSASS, rather than detecting specific tools.

[williballenthin]

do you have an associated sample that you used during development?

[williballenthin]

why both the APIs and the match?

[akshat4703]

wrong thinking from my side, match: open process already covers OpenProcess, NtOpenProcess, and ZwOpenProcess, so I’ll remove the explicit API entries and keep the match-based form.

[akshat4703]

do you have an associated sample that you used during development?

Yes, I used 91a12a4cf437589ba70b1687f5acad19.exe_ during development (the same sample used by the existing create process memory minidump rule). I’ll add it under meta.examples for this rule.