HackTool - HandleKatz LSASS Dumper Execution

About the rule

Rule Type

Standard

Rule Description

Detects the use of HandleKatz, a tool that utilizes cloned handles to the LSASS process to create obfuscated memory dumps for credential dumping purposes on Windows systems.

Severity

Trouble

Rule journey

Attack chain scenario

Credential Access (T1003.001) → Lateral Movement → Privilege Escalation → Full Compromise

Impact

Compromise of credentials through extraction from LSASS memory, enabling lateral movement, privilege escalation, and further system compromise.

Rule Requirement

Prerequisites

Using Windows Event Viewer (GPO method)

1. Log in to a domain controller.
2. Open Group Policy Management (gpmc.msc).
3. Create or edit a GPO linked to the target OU.
4. Navigate to:
   Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Audit Policies → Detailed Tracking
   • Enable “Audit Process Creation” (Success)
   • Enable “Audit Process Termination” (Success)
5. Navigate to:
   Computer Configuration → Administrative Templates → System → Audit Process Creation
   1. Enable “Include command line in process creation events”
6. Open Registry Editor and create the key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Security-Auditing\Operational

Using Sysmon

1. Download Sysmon from Microsoft Sysinternals.
2. Run installation with configuration file that includes ProcessCreate monitoring.
3. Open Registry Editor and create the key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Sysmon\Operational

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

T1003.001 – OS Credential Dumping: LSASS Memory

Security Standards

Implementation of endpoint behavior prevention, credential access protections like Credential Guard, OS hardening by disabling vulnerable authentication protocols, and privileged account management to reduce attack surface.

Author

Florian Roth (Nextron Systems)

Future actions

Known False Positives

Unknown; detection is based on specific command-line parameters and process hashes indicative of HandleKatz activity.

Next Steps

• Investigate detected execution instances for legitimacy and context.
• Harden endpoint defenses by enabling Attack Surface Reduction (ASR) rules and Credential Guard.
• Enforce password complexity and privileged account restrictions.
• Monitor process creation logs continuously for suspicious LSASS access attempts.
• Conduct user and administrator training on credential security best practices.

Mitigation