AN1030 Analytic 1030

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>A non-privileged or abnormal process attempts to open a handle with full access (0x1F0FFF) to lsass.exe and subsequently invokes memory dump, file creation, or registry modification indicative of credential scraping. This behavior chain reflects staged credential theft activity.</p>

Detects: T1003.001 LSASS Memory
Part of: DET0363 Detection of Credential Dumping from LSASS Memory via Access and Dump Sequence

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Sysmon	`EventCode=10`	DC0035 Process Access
WinEventLog:Sysmon	`EventCode=1`	DC0032 Process Creation
WinEventLog:Sysmon	`EventCode=11`	DC0039 File Creation
WinEventLog:Security	`EventCode=4673`	DC0013 User Account Metadata
WinEventLog:Sysmon	`EventCode=13, 14`	DC0063 Windows Registry Key Modification

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`AccessMask`	Set to 0x1F0FFF to detect full memory access attempts; can be scoped down to reduce noise.
`TimeWindow`	Defines time between LSASS access and dump file creation or registry modification (e.g., 5 minutes).
`ParentProcessName`	Allowlist known legitimate tools (e.g., AV/EDR) accessing lsass.exe.
`DumpFilePath`	Paths where memory dumps are written, e.g., %TEMP%, C:\Windows\Temp.
`CommandLinePattern`	Common dumping syntax like rundll32, procdump, comsvcs.dll, Invoke-Mimikatz.

KEV CVEs whose mapped technique this analytic detects

CVE	Vendor / product	State
CVE-2023-26360	Adobe ColdFusion	Mapped
CVE-2024-4577	PHP Group PHP	Mapped
CVE-2025-32701	Microsoft Windows	Mapped
CVE-2025-32706	Microsoft Windows	Mapped