Loading story…
Microsoft documents ProcDump as a legitimate Sysinternals command-line utility for capturing process dump files on Windows, including full and mini dumps triggered by crashes, hangs, CPU spikes, memory thresholds, and other conditions. The tool supports extensive command-line options and can be used for postmortem debugging, making it common in enterprise troubleshooting workflows.
Splunk Threat Research highlighted that attackers can abuse ProcDump to dump the LSASS process and extract credentials, particularly when the binary is renamed to evade simple detections. The hunting logic focuses on Windows process-creation telemetry where the executable's OriginalFileName remains procdump but the running file name is different, and the command line references lsass with dump options such as -ma or -mm; the behavior is mapped to MITRE ATT&CK T1003.001 for LSASS memory credential access.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the hunting detection "Dump LSASS via procdump Rename" from its content library in version 5.2.0 and indicated it was replaced by "Dump LSASS via procdump." The detection had been intended to identify renamed ProcDump binaries used to dump LSASS memory.
Microsoft Learn published the ProcDump Sysinternals documentation page describing the utility's process-monitoring and dump-generation capabilities, supported dump types, triggers, and platform support. The page also links to ProcDump versions for Linux and Mac.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft patched the Windows user-mode **Protected Process Light (PPL)** Known DLL loading behavior abused by PPLdump to inject arbitrary code into protected processes, including `LSASS`. The technique relied on creating a malicious `\KnownDlls` symbolic link through arbitrary object-directory creation, an exploitation primitive previously documented by Google Project Zero for local privilege escalation scenarios. Testing on Windows 10 21H2 build `19044.1826` showed PPLdump could still create the malicious symbolic link, but the protected target process no longer loaded the hijacked DLL. Analysis of `NTDLL` identified a change in `LdrpInitializeProcess`, controlled by `Feature_Servicing_2206c_38427506__private_IsEnabled`, that makes both Protected Processes and PPLs bypass Known DLLs. The update closes this specific user-mode PPL bypass, though other weaknesses affecting PPL protections may remain.
Sep 9, 2026
Project Black researcher Eddie Zhang reported that a community-modified, locally hosted **Qwen 3.8 27B** model altered a Windows LSASS credential-dumping executable so that it avoided detection by two unnamed EDR products in a controlled lab test. The initial tool, generated by DeepSeek v4 Flash 0731, created an encrypted, parsable LSASS minidump but was detected; after a minimal request to make it stealthier, the uncensored local model modified the executable and reportedly produced no alerts. The result does not establish a universal EDR bypass because the tested products and configurations were not disclosed, but it shows how guardrail-free local AI can reduce the time and expertise needed to tailor post-exploitation credential theft tools. Organizations should harden LSASS using Attack Surface Reduction rules, Protected Process Light and Credential Guard; enforce least privilege and privileged-account separation; and monitor for anomalous LSASS access and credential-dumping behavior.
Sep 26, 2026
Splunk removed several Windows-focused detections from its Threat Research content library and Enterprise Security workflows, citing renamed analytics, overly broad logic, excessive noise, or reduced effectiveness against current attacker tradecraft. The retired content covered **local administrator account creation** with `net.exe`, **domain and local account discovery**, **domain and privileged group enumeration**, **Excel spawning PowerShell**, **Mimikatz-related credential dumping**, and an **Investigation** for pass-the-hash activity based on Windows Event ID `4624` with `Logon_Type 9`. Splunk said most of the detections were removed in content library version `5.2.0`, while the pass-the-hash investigation was dropped because Enterprise Security `8.0` no longer supports Investigations. The affected detections mapped to common ATT&CK behaviors including `T1136.001` (local account creation), `T1087.001` and `T1087.002` (account discovery), `T1069.002` (domain group discovery), `T1003.001` (LSASS memory), and pass-the-hash activity involving dumped **NTLM** credentials. The changes reflect the difficulty of reliably detecting Windows credential access and reconnaissance techniques that remain widely used by threat actors, including **SAM** hive dumping (`T1003.002`) with tools such as **Mimikatz**, **Impacket/SecretsDump**, **CrackMapExec**, and **Cobalt Strike**, as documented by MITRE ATT&CK. Splunk directed users to newer replacements such as **Windows Create Local Administrator Account Via Net**, **Windows User Discovery Via Net**, **Windows Group Discovery Via Net**, **Windows Sensitive Group Discovery With Net**, and **Windows Office Product Spawned Uncommon Process**.
Aug 12, 2026