LSA Policy Secrets subkey or LSA dumper module invoked

Siemphony@siemphonyhighT1003.004verified in lab

MITRE's analytic names two routes to LSA secrets: reading the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets, and scraping them out of LSASS memory with Mimikatz or PowerSploit's Invoke-Mimikatz. Both leave their trace on the command line, so this rule matches the Policy key path in its reg.exe and PowerShell-provider spellings alongside the two dumper invocations MITRE cites, which is the whole of the analytic that a single process-creation event can carry. The memory-access half is not written against Process Access here on purpose: a handle to lsass.exe is already covered by the T1003 and T1003.001 rules in this corpus, and repeating it would give three rules with one meaning. The neighbouring T1003.002 rule matches a save or export of the SECURITY hive as a whole; this one matches the Policy subkey and the LSA-specific modules, so the two do not collapse into each other. The brief maps this category to Sysmon EventID 1, which carries CommandLine by default — if the feed is Security 4688 instead, both Audit Process Creation and the separate policy that includes the command line must be enabled or every field this rule reads is empty. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0437, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "SECURITY\\Policy\\Secrets" or ProcessCommandLine contains "HKLM\\SECURITY\\Policy" or ProcessCommandLine contains "HKLM:\\SECURITY\\Policy" or ProcessCommandLine contains "lsadump::secrets" or ProcessCommandLine contains "lsadump::lsa" or ProcessCommandLine contains "Invoke-Mimikatz")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*SECURITY\\Policy\\Secrets*" OR CommandLine="*HKLM\\SECURITY\\Policy*" OR CommandLine="*HKLM:\\SECURITY\\Policy*" OR CommandLine="*lsadump::secrets*" OR CommandLine="*lsadump::lsa*" OR CommandLine="*Invoke-Mimikatz*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*security\\\\policy\\\\secrets*" OR TO_LOWER(process.command_line) LIKE "*hklm\\\\security\\\\policy*" OR TO_LOWER(process.command_line) LIKE "*hklm:\\\\security\\\\policy*" OR TO_LOWER(process.command_line) LIKE "*lsadump::secrets*" OR TO_LOWER(process.command_line) LIKE "*lsadump::lsa*" OR TO_LOWER(process.command_line) LIKE "*invoke-mimikatz*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(SECURITY\\Policy\\Secrets|HKLM\\SECURITY\\Policy|HKLM:\\SECURITY\\Policy|lsadump::secrets|lsadump::lsa|Invoke-Mimikatz)</field>    <description>LSA Policy Secrets subkey or LSA dumper module invoked</description>    <mitre>      <id>T1003.004</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: credential_dump
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a280bfeb-e311-4586-8ebb-9d6a56935c63

ATT&CKT1003.004

T1003.004LSA Secrets

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessoncredential dump

credential dumpAI draft — unreviewed

01 · What this rule detects

A single process-creation event whose command line contains one of six literal strings: three spellings of the LSA policy registry path, and three Mimikatz invocations. AN1212 describes two routes to LSA secrets — reading HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets from the registry, and scraping them out of LSASS memory with Mimikatz — across five log sources (Security 4663/4670/4656, Sysmon EventID 1, 10 and 7) joined by a TimeWindow knob "between registry access and command-line tool execution." This rule takes the EventID 1 leg only. The memory-access half was deliberately left to the T1003 and T1003.001 rules in this corpus rather than written a third time — though that boundary leaks.

02 · Telemetry you need

category: process_creation / product: windows, verbatim from AN1212's Sysmon EventID 1 entry. Sysmon EID 1 carries CommandLine by default.
If your feed is Security 4688 instead, two separate policies must be on: Audit Process Creation, and the distinct Include command line in process creation events setting. Neither is in a default install or the CIS baseline. Without the second, CommandLine is empty and every one of these six selectors is dead — the Sentinel translation targets SecurityEvent | where EventID == 4688, so this is the likely deployment, not a hypothetical. All four backends render this rule.

03 · How the logic works

One selection, one field, six alternatives OR-ed:

The first three are the same key in three vocabularies: the full subkey, the reg.exe short form, and HKLM: with a colon — the PowerShell provider spelling, which Get-ChildItem HKLM:\SECURITY\Policy produces and which a reg.exe-only pattern would miss. That third entry is the kind of small completeness that separates a working rule from a demo. contains rather than endswith is right because the path is an argument in the middle of a line. The last three are MITRE's own examples turned into strings. And this is where the reviewer's first finding lands: four of the six selectors are not LSA Secrets. Invoke-Mimikatz with default arguments runs sekurlsa::logonpasswords, which is T1003.001 — the exact rule the description says it is avoiding duplicating. lsadump::lsa dumps the whole LSA database including SAM hashes, so it straddles T1003.002. Only lsadump::secrets and the registry spellings are specific to this sub-technique, and those are the quietest terms in the list. Most alerts this rule produces will be duplicates of its neighbours wearing a T1003.004 label. The second finding is worse for coverage. The registry route as the technique text actually describes it is reg save HKLM\SECURITY followed by offline DPAPI decryption — because Policy\Secrets values are encrypted blobs that reg query returns as raw binary. The description hands the hive-save form to T1003.002, which leaves the registry half here matching only the less common direct-query form. Not dead, but the dominant command is excluded by design; hunt both rules together.

04 · Common false positives

Authorised offensive testing. Red-team engagements, purple-team exercises
DFIR triage collectors — the reviewer's addition, and the one the rule
Substring matches on a path rather than an action: an AV scan or an archiver
Genuine LSA-policy troubleshooting by admins or vendor support, from a SYSTEM

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0437, never executed against a log line. It will certainly catch a careless Mimikatz operator; that is a paper trace, not a measurement, and says nothing about how often your own tooling trips it.
tier_2: confirm CommandLine is populated in your feed (run reg query HKLM\SECURITY\Policy on a test host and check the event carries the argument), then run read-only through one IR-collection cycle and one test window and convert the survivors into exclusions.
tier_3: is MITRE's correlation — registry access followed by tool execution inside a TimeWindow, plus the EventID 7 module-load leg — which Sigma cannot express.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude your IR tooling by parent process and path, not by command line.
Split the rule. Keep lsadump::secrets and the three registry spellings at
MITRE's `TargetObject` knob, populated here with the three path spellings —
Understand the ceiling. Every selector is a literal on a command line, and
Knobs with no field here: AccessMask and ImageLoaded belong to the EventID

Declared by the author

Authorised offensive testing — red-team engagements, purple-team exercises and detection-validation suites such as Atomic Red Team, which run these exact commands on purpose. On an estate that tests regularly this is the most common hit, and only the source host, the operator account and the agreed window separate it from the real thing.
Substring matches on an argument that is a path rather than an action: an antivirus scan, an archiver or a file-copy command whose target is a sample or a report named after Invoke-Mimikatz matches the command line without anything being executed.
Administrators and vendor support scripts reading HKLM SECURITY Policy while troubleshooting LSA policy, secure-channel or cached-credential problems. This requires a SYSTEM context, usually obtained with a service wrapper, so it is rare but entirely legitimate when it happens.
Security training and documentation pasted into an interactive console, where the string is typed but the tool is absent. The rule tests for the text of the invocation, not for a successful read of the key.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — LSA secrets dumped after a PsExec lateral move
passed
Siemphony IR · 3 Sept 2026
4 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1003.004, evaluated against their process_creation events.

Share this rule

/u/siemphony/a280bfeb-e311-4586-8ebb-9d6a56935c63

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

LSA Policy Secrets subkey or LSA dumper module invoked

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it