tool
Windows Credential Editor is a password dumping tool. [1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Windows Credential Editor can dump credentials.2
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.
6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
99th percentile · 99% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
90 distinct rules cover the 1 technique recorded for this tool. 79 Sigma · 11 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Splunk | The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. (...) | Generic | stable | process_access | windows | Sysmon | - | medium | Patrick Bareiss, Splunk | 2019-12-11 | 2026-10-09 | fb4c31b0-13e8-4155-8aa5-24de4b8d6717 | |||
Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...) | Generic | stable | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2018-09-09 | 2026-06-15 | 78cc2dd2-7d20-4d32-93ff-057084c38b93 | ||||
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2019-02-21 | 2023-03-10 | 03e2746e-2b31-42f1-ab7a-eb39365b2422 | ||||
Splunk | This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | medium | Nasreddine Bencherchali, Splunk, Talos NTDR | 2025-04-16 | 2026-05-13 | 7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae | ||||
Splunk | The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). (...) | Generic | stable | create_remote_thread | windows | Sysmon | - | medium | Patrick Bareiss, Splunk | 2019-12-11 | 2026-06-29 | 67d4dbef-9564-4699-8da8-03a151529edc | |||
Detects uses of the createdump.exe LOLOBIN utility to dump process memory | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) | 2022-01-04 | 2022-08-19 | 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48 | ||||
Splunk | The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. (...) | Generic | stable | file_event | windows | Sysmon | - | medium | Michael Haag, Splunk | 2019-12-11 | 2026-10-02 | b2fbe95a-9c62-4c12-8a29-24b97e84c0cd | |||
Files with well-known filenames (parts of credential dump software or files produced by them) creati (...) | Generic | test | file_event | windows | Sysmon | - | high | Teymur Kheirkhabarov, oscd.community | 2019-11-01 | 2025-10-25 | 8fbf3271-1ef6-4e94-8210-03c2317947f6 | ||||
Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz. | Generic | stable | process_access | windows | Sysmon | - | high | Bhabesh Raj, Jonhnathan Ribeiro | 2023-11-27 | 2023-11-29 | f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9 | ||||
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up. | Generic | test | process_access | windows | Sysmon | - | high | Florian Roth (Nextron Systems) | 2022-06-27 | 2023-11-29 | e5b33f7d-eb93-48b6-9851-09e1e610b6d7 | ||||
Detects well-known credential dumping tools execution via service execution events | Generic | test | service | windows | WinEventLog Security | - | high | Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community | 2017-03-05 | 2022-11-29 | f0d1feba-4344-4ca9-8121-a6c97bd6df52 | ||||
Detects well-known credential dumping tools execution via service execution events | Generic | test | service | windows | WinEventLog System | - | high | Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community | 2017-03-05 | 2022-11-29 | 4976aa50-8f41-45c6-8b15-ab3fc10e79ed | ||||
Detects the load of dbghelp/dbgcore DLL by a potentially uncommon or potentially suspicious process. (...) | Hunting | test | image_load | windows | Sysmon | - | medium | Perez Diego (@darkquassar), oscd.community, Ecco | 2019-10-27 | 2024-03-01 | 0e277796-5f23-4e49-a490-483131d4f6e1 | ||||
Splunk | The following analytic detects attempts to read LSASS memory, indicative of credential dumping. (...) | Generic | stable | process_access | windows | Sysmon | - | medium | Patrick Bareiss, Splunk | 2019-12-11 | 2026-10-09 | 2c365e57-4414-4540-8dc0-73ab10729996 | |||
Splunk | The following analytic detects the behavior of dumping credentials from memory by exploiting the Local Security Authority Subsystem Service (LSASS) using the comsvcs.dll and MiniDump via rundll32. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Patrick Bareiss, Splunk | 2019-10-16 | 2026-10-02 | 8943b567-f14d-4ee8-a0bb-2121d4ce3184 | |||
Splunk | The following analytic detects the use of procdump.exe to dump the LSASS
process, specifically looki (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-02-01 | 2026-10-02 | 3742ebfe-64c2-11eb-ae93-0242ac130002 | |||
Detects process dump via legitimate sqldumper.exe binary | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Kirill Kiryanov, oscd.community | 2020-10-08 | 2021-11-27 | 23ceaf5c-b6f1-4a32-8559-f2ff734be516 | ||||
Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of t (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) | 2022-04-06 | 2023-04-12 | dee0a7a3-f200-4112-a99b-952196d81e42 | ||||
Detects file creation events with filename patterns used by CrackMapExec. | Generic | test | file_event | windows | Sysmon | - | high | Nasreddine Bencherchali (Nextron Systems) | 2024-03-11 | 2024-06-27 | 736ffa74-5f6f-44ca-94ef-1c0df4f51d2a | ||||
Detects suspicious process patterns found in logs when CrackMapExec is used | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2022-03-12 | 2023-02-13 | f26307d8-14cd-47e3-a26b-4b4769f24af6 | ||||
Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential ext (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2019-12-22 | 2024-11-23 | 36d88494-1d43-4dc0-b3fa-35c8fea0ca9d | ||||
Detects well-known credential dumping tools execution via specific named pipe creation | Generic | test | pipe_created | windows | Sysmon | - | critical | Teymur Kheirkhabarov, oscd.community | 2019-11-01 | 2023-08-07 | 961d0ba2-3eea-4303-a930-2cf78bbfcc5e | ||||
Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process clo (...) | Generic | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-07-01 | — | d474c8fe-bb69-4ea0-b7d9-f682b56d52d3 | ||||
Detects the creation of the default dump file used by Outflank Dumpert tool. (...) | Generic | test | file_event | windows | Sysmon | - | critical | Florian Roth (Nextron Systems) | 2020-02-04 | 2023-05-09 | 93d94efc-d7ad-4161-ad7d-1638c4f908d8 | ||||
Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2020-02-04 | 2026-09-16 | 2704ab9e-afe2-4854-a3b1-0c0706d03578 | ||||
Detects process access requests from hacktool processes based on their default image name | Generic | test | process_access | windows | Sysmon | - | high | Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel | 2023-11-27 | — | d0d2f720-d14f-448d-8242-51ff396a334e | ||||
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening an (...) | Generic | test | process_access | windows | Sysmon | - | high | Bhabesh Raj (rule), @thefLinkk | 2022-06-27 | 2023-11-28 | b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5 | ||||
Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in orde (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2022-08-18 | 2024-11-23 | ca621ba5-54ab-4035-9942-d378e6fcde3c | ||||
Detects file creation events with filename patterns used by Impacket. | Generic | experimental | file_event | windows | Sysmon | - | high | The DFIR Report, IrishDeath | 2025-05-19 | — | 03f4ca17-de95-428d-a75a-4ee78b047256 | ||||
Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Nasreddine Bencherchali (Nextron Systems) | 2022-10-24 | 2023-02-04 | b99a1518-1ad5-4f65-bc95-1ffff97a8fd0 | ||||
Detection well-known mimikatz command line arguments | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton | 2019-10-22 | 2023-02-21 | a642964e-bead-4bed-8910-1bb4d63e3b4d | ||||
Detects default lsass dump filename generated by SafetyKatz. | Generic | test | file_event | windows | Sysmon | - | high | Markus Neis | 2018-07-24 | 2024-06-27 | e074832a-eada-4fd7-94a1-10642b130e16 | ||||
Detects the execution of the hacktool SafetyKatz via PE information and default Image name | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Nasreddine Bencherchali (Nextron Systems) | 2022-10-20 | 2023-02-04 | b1876533-4ed5-4a83-90f3-b8645840a413 | ||||
Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2019-12-31 | 2025-10-21 | 7aa7009a-28b9-4344-8c1f-159489a390df | ||||
Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (...) | Generic | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-11-23 | 2026-01-09 | 589ac73f-8e12-409c-964e-31a2f5775ae2 | ||||
Detects suspicious use of XORDump process memory dumping utility | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2022-01-28 | 2023-02-08 | 66e563f9-1cbd-4a22-a957-d8b7c0f44372 | ||||
Detects Access to LSASS Process | Generic | test | - | windows | Windows Defender | - | high | Markus Neis | 2018-08-26 | 2022-08-13 | a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98 | ||||
Detects potential mimikatz-like tools accessing LSASS from non system account | Generic | test | file_event | windows | WinEventLog Security | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2019-06-20 | 2023-12-11 | 962fe167-e48d-4fd6-9974-11e5b9a5d6d1 | ||||
Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as (...) | Generic | test | process_access | windows | Sysmon | - | high | Florian Roth (Nextron Systems) | 2022-02-10 | 2023-11-29 | 4be8b654-0c01-4c9d-a10c-6b28467fc651 | ||||
Detects process access to LSASS memory with suspicious access flags and from a potentially suspiciou (...) | Hunting | test | process_access | windows | Sysmon | - | medium | Florian Roth (Nextron Systems) | 2021-11-27 | 2026-09-15 | fa34b441-961a-42fa-a100-ecc28c886725 | ||||
Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | E.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2019-10-24 | 2023-08-29 | ffa6861c-4461-4f59-8a41-578c39f3f23e | ||||
Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | @pbssubhash | 2022-12-08 | 2023-08-17 | 33efc23c-6ea2-4503-8cfe-bdf82ce8f719 | ||||
Detects LSASS process access requests from a source process with the "dump" keyword in its image name. | Generic | test | process_access | windows | Sysmon | - | high | Florian Roth (Nextron Systems) | 2022-02-10 | 2023-11-29 | 9bd012ee-0dff-44d7-84a0-aa698cfd87a3 | ||||
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass. | Generic | test | process_access | windows | Sysmon | - | high | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) | 2020-10-20 | 2023-11-29 | a49fa4d5-11db-418c-8473-1e014a8dd462 | ||||
Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service). (...) | Generic | experimental | - | windows | WinEventLog Application | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-12-07 | 2025-12-03 | a18e0862-127b-43ca-be12-1a542c75c7c5 | ||||
Detects the presence of an LSASS dump file in the "CrashDumps" folder. (...) | Generic | test | file_event | windows | Sysmon | - | high | @pbssubhash | 2022-12-08 | — | 6902955a-01b7-432c-b32a-6f5f81d8f625 | ||||
Detects the creation of an "lsass.dmp" file by the taskmgr process. (...) | Generic | test | file_event | windows | Sysmon | - | high | Swachchhanda Shrawan Poudel | 2023-10-19 | — | 69ca12af-119d-44ed-b50f-a47af0ebc364 | ||||
Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials. | Generic | test | file_event | windows | Sysmon | - | high | Florian Roth (Nextron Systems) | 2021-11-15 | 2024-10-08 | a5a2d357-1ab8-4675-a967-ef9990a59391 | ||||
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimi (...) | Generic | test | - | windows | - | - | high | Florian Roth (Nextron Systems), David ANDRE (additional keywords) | 2017-01-10 | 2022-01-05 | 06d71506-7beb-4f22-8888-e2e5e2ca7fd8 | ||||
Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main mo (...) | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems), Tom Ueltschi | 2019-01-16 | 2022-12-15 | 79aeeb41-8156-4fac-a0cd-076495ab82a1 |
98th percentile · 98% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
100th percentile · None of the 825 ATT&CK software entries has more mitigations per technique — the highest in the population.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 1 Enterprise technique.
Technique Campaign use over its cumulative rule count.