LSASS minidump file for mimikatz

Hunt Hypothesis

This detection identifies adversaries leveraging Mimikatz to create LSASS memory dumps, a technique used to extract credentials and facilitate lateral movement within the environment. Proactive hunting is essential in Azure Sentinel because these minidump operations often occur with low severity but can serve as a critical precursor to more severe credential theft incidents that may otherwise go unnoticed until after compromise.

YARA Rule

rule mimikatz_lsass_mdmp
{
	meta:
		description		= "LSASS minidump file for mimikatz"
		author			= "Benjamin DELPY (gentilkiwi)"

	strings:
		$lsass			= "System32\\lsass.exe"	wide nocase

	condition:
		(uint32(0) == 0x504d444d) and $lsass
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the LSASS minidump file for mimikatz detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Backup by Enterprise Endpoint Protection Suite

  • Context: Major endpoint security platforms (e.g., Microsoft Defender for Identity, CrowdStrike Falcon, or Carbon Black) often include a scheduled task that creates periodic memory snapshots of the lsass.exe process to analyze credential theft risks or perform health checks. These tools generate minidump files in standard locations like C:\ProgramData\Microsoft\Windows Defender\Support.
  • Suggested Filter/Exclusion: Exclude events where the parent process name matches known security agents (e.g., MsMpEng.exe, FalconSensorService.exe) or where the file path contains specific vendor directories.
    • Filter Logic: ParentProcessName IN ('MsMpEng.exe', 'FalconSensorService.exe') AND FilePath CONTAINS '\Windows Defender\Support\'

• Scenario: Automated Health Monitoring by IT Operations Team

  • Context: The IT operations team utilizes a custom PowerShell script or a monitoring tool (e.g., SolarWinds NPM, PRTG) running under a dedicated service account (e.g., DOMAIN\svc-monitor) to collect LSASS memory dumps during off-hours for performance trending and capacity planning. This is often triggered by a scheduled Task Scheduler job named “LSASS_Health_Check”.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the specific user account running the task and the command line arguments used to invoke the dump.
    • Filter Logic: UserName == 'DOMAIN\svc-monitor' AND CommandLine CONTAINS '--dump-type=memory'

• Scenario: Post-Patch Validation by System Administrators

  • Context: Following a major