MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1003.001LSASS Memory

Credential Access

View on MITRE ATT&CK →

2 Queries

LSASS Memory Access by Suspicious Process

criticalproductionMicrosoft Sentinel

Microsoft Defender for Endpoint·DeviceProcessEvents

DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("procdump.exe", "procdump64.exe", "rundll32.exe", "taskmgr.exe") or ProcessCommandLine has_any ("lsass", "sekurlsa", "MiniDump", "comsvcs")
| where ProcessCommandLine has "lsass" or FileName in~ ("procdump.exe", "procdump64.exe")
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "svchost.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc

triathIC · last tested 2025-03-01

attack.mitre.org
learn.microsoft.com

+ Add another query for this technique →