Crowdstrike Credential Dumping Tool

Description

Detects execution of credential dumping tools like Mimikatz, ProcDump, and Lazagne that extract passwords, hashes, and Kerberos tickets from memory and credential stores. These tools enable lateral movement, privilege escalation, and persistent access by allowing attackers to authenticate as legitimate users. This detection identifies a critical attack phase where adversaries transition from initial compromise to broader network access.

Query · python

from panther_crowdstrike_fdr_helpers import crowdstrike_detection_alert_context

CREDENTIAL_DUMPING_TOOLS = {
    "mimikatz.exe",
    "secretsdump.py",
    "pwdump.exe",
    "fgdump.exe",
    "gsecdump.exe",
    "samdump2.exe",
    "quarks-pwdump.exe",
    "cachedump.exe",
    "lsadump.exe",
    "procdump.exe",
    "mimipenguin.sh",
    "mimidogz.ps1",
    "logonpasswords.exe",
    "pypykatz.exe",
    "dsusers.py",
    "ntdsgrab.py",
    "lazagne.exe",
    "creddump7.exe",
    "keethief.ps1",
    "inveigh.exe",
    "sharpkatz.exe",
    "dumpert.exe",
    "hivedump.exe",
    "kerbrute.exe",
    "sessiongopher.ps1",
}


def rule(event):
    if event.get("fdr_event_type", "") == "ProcessRollup2":
        if event.get("event_platform", "") == "Win":
            process_name = (
                event.deep_get("event", "ImageFileName", default="").lower().split("\\")[-1]
            )
            if process_name in CREDENTIAL_DUMPING_TOOLS:
                return True
    return False


def title(event):
    tool = (
        event.deep_get("event", "ImageFileName", default="<TOOL_NOT_FOUND>").lower().split("\\")[-1]
    )
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    return f"Crowdstrike: Credential dumping tool [{tool}] detected on host [{host}]"


def alert_context(event):
    return crowdstrike_detection_alert_context(event)

Analyst notes

Review the process tree in CrowdStrike for event:ParentBaseFileName and event:SourceProcessId to determine what launched the credential dumping tool and identify if this was manual execution or automated malware
Search CrowdStrike logs and Windows Event Logs for all users who logged into the affected host (aid and aip) in the 7 days before this alert, then hunt for lateral movement attempts from those user accounts to other systems
Query CrowdStrike for the event:SHA256HashData across all endpoints to identify if the same credential dumping tool was executed on other hosts in the environment

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Critical
Status: Stable
Query type: python
Created: 2023-05-01
Modified: 2026-02-13
Authored by: panther-labs
Source ID
Upstream: rules/crowdstrike_rules/crowdstrike_credential_dumping_tool.yml
Type: rule
Version: 2
References: https://www.crowdstrike.com/blog/adversary-credential-theft/
Data sources: Crowdstrike.FDREvent

ATT&CK

TA0006 T1003 T1003.001