1
Name-dependent detections
All three published nanodump detections depend on the literal string dump.
Renaming attacker-controlled artifacts reduces nanodump coverage from 3 detections to 0.
Detection engineering research · MITRE ATT&CK T1003.001
A reproducible evaluation of published Windows detections for LSASS credential dumping, measured against seven recorded implementations and then stressed with operator-controlled changes such as renaming and relocation.
Merged upstream: The benchmark's Dumpert hash-type correction was approved on 2026-09-21 and merged into SigmaHQ on 2026-09-24 as PR #6311.
Executive summary
Published detection coverage is materially sensitive to artifacts controlled by the operator. Renaming alone removes 12 of 35 baseline rule/capture detections. Relocation removes eight more. No additional loss is observed in this selected population when PE version metadata is cleared or recorded fingerprints are rotated.
Study design
The benchmark pins both the Sigma rule corpus and input datasets, compiles rule logic, evaluates each capture, applies cumulative operator changes, classifies misses, and then checks selected results against an independent engine.
Behaviour reported by the operating system is not rewritten. The mutations target operator-controlled artifacts, not the way the memory-access behavior itself is performed.
Primary experiment
T3/T4 stability applies to the selected population in this benchmark. It does not show that version-resource or fingerprint changes never matter elsewhere.
Observed failure modes
All three published nanodump detections depend on the literal string dump.
Renaming attacker-controlled artifacts reduces nanodump coverage from 3 detections to 0.
Process-access rules exclude common directories such as Program Files,
System32 and SysWOW64. Relocating the tool into those paths suppresses
coverage even when the behavioral event remains.
The Dumpert-specific rule records an import hash as MD5=. The recorded executable
event carries that same value as IMPHASH=, causing the hash branch to miss.
Coverage interpretation
The benchmark separates rule failures from missing data and from rules that were never intended to cover the tool used in a given capture. This prevents the result from turning into a simplistic “rules that fired vs rules that did not” score.
Total: 581 rule × capture pairs in the augmented evaluation.
Validation
Upstream impact
SigmaHQ's Dumpert rule uses
MD5=09D278F9DE118EF09163C6140255C690. The repository itself and a recorded
Dumpert execution identify that value as an import hash instead.
Recorded event:
MD5=69C05093EB542E1C29A556A29E74E99A
IMPHASH=09D278F9DE118EF09163C6140255C690
Approved by a SigmaHQ collaborator on 2026-09-21 and merged on 2026-09-24.
Authored detections
The authored rules were created after inspecting measured coverage gaps. Non-target rates below describe the eligible evaluation corpus for each technique; they are not production false-positive rates.
| Rule | ATT&CK | Attack captures | Non-target fires / 100k |
|---|---|---|---|
| LSASS Handle Request From Unexpected Process | T1003.001 | 7 / 7 | 1.56 |
| Process Started From A User Download Directory | T1204.002 | 7 / 7 | 0.99 |
| SeDebugPrivilege Enabled On A Token | T1134.001 | 4 / 7 | 1.48 |
| Remote Thread Started From Unbacked Memory | T1055.002 | 3 / 7 | 1.02 |
| LSASS Dump Via Comsvcs MiniDump Export | T1003.001 | 1 / 7 | 0.00 |
| PowerShell Script Block Calling MiniDumpWriteDump | T1003.001 | 1 / 7 | 0.00 |
Scope and limitations
Seven tools is seven tools, and one lab is one lab. The mutation ladder models inexpensive operator behavior rather than replaying a second set of real intrusions. Missing telemetry in a capture is not treated as evidence that the corresponding detection logic failed.
Reproducibility
Source repositories are pinned to commits, capture archives are pinned by SHA-256, generated figures are derived from committed benchmark JSON, and CI checks that the report has not drifted from those files.