LSA dump programe (bootkey/syskey) - pwdump and others

Hunt Hypothesis

This detection identifies adversaries executing tools like pwdump to extract the Local Security Authority (LSA) secret from memory, a critical step for offline credential cracking or pass-the-hash attacks. Proactively hunting for this activity in Azure Sentinel is essential because LSA dumping often occurs early in an attack chain and can be missed by standard alerts due to its low severity classification, allowing attackers to silently harvest credentials before escalating privileges.

YARA Rule

rule lsadump
{
	meta:
		description		= "LSA dump programe (bootkey/syskey) - pwdump and others"
		author			= "Benjamin DELPY (gentilkiwi)"

	strings:
		$str_sam_inc	= "\\Domains\\Account" ascii nocase
		$str_sam_exc	= "\\Domains\\Account\\Users\\Names\\" ascii nocase
		$hex_api_call	= {(41 b8 | 68) 00 00 00 02 [0-64] (68 | ba) ff 07 0f 00 }
		$str_msv_lsa	= { 4c 53 41 53 52 56 2e 44 4c 4c 00 [0-32] 6d 73 76 31 5f 30 2e 64 6c 6c 00 }
		$hex_bkey		= { 4b 53 53 4d [20-70] 05 00 01 00}

	condition:
		( ($str_sam_inc and not $str_sam_exc) or $hex_api_call or $str_msv_lsa or $hex_bkey )
      and not uint16(0) == 0x5a4d
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the LSA dump program (bootkey/syskey) detection rule, including legitimate use cases and suggested filters:

• Scheduled Password Export by IT Operations

  • Scenario: The Help Desk or Identity team runs a nightly scheduled task using pwdump.exe or mimikatz to export user credentials for a quarterly audit or migration project. This process intentionally triggers the LSA dump event on Domain Controllers during off-hours (e.g., 2:00 AM).
  • Suggested Filter: Create an exclusion based on the Process Name (pwdump.exe, mimikatz.exe) combined with a Time Window (e.g., 01:00–05:00) and restrict it to specific Source Hosts known for maintenance tasks.

• Automated Backup Routine via Veeam or Commvault

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault perform stateful backups of Domain Controllers. These tools often invoke syskey or similar utilities to extract the boot key and ensure data consistency before snapshotting, triggering the detection logic without malicious intent.
  • Suggested Filter: Exclude events where the Parent Process is a known backup service (e.g., Veeam.Backup.Service.exe, commvault.cmd) or filter by User Account if the task runs under a dedicated service account like DOMAIN\BackupSvc.

• Manual Forensic Investigation by Security Team

  • Scenario: A SOC analyst or incident responder manually executes tools like pwdump or lsadump on a specific server to investigate a separate alert. This is an authorized, human-initiated action rather than an automated attack vector.
  • Suggested Filter: Implement a filter based