name: Credential Dumping LSASS memory test
detections:
  - name: Access LSASS Memory for Dump Creation
    pass_condition: '| stats count | where count > 0'
  - name: Create Remote Thread into LSASS
    pass_condition: '| stats count | where count > 0'
  - name: Detect Credential Dumping through LSASS access
    pass_condition: '| stats count | where count > 0'
  - name: Dump LSASS via comsvcs DLL
    pass_condition: '| stats count | where count > 0'
  - name: Unsigned Image Loaded by LSASS
    pass_condition: '| stats count | where count > 0'
description: Test credential dumping detections
target: attack-range-windows-domain-controller
simulation_technique: 'T1003.001'