Why does hunting for LSASS credential dumping by tool name miss most of the technique?

## Three different levels, and only one of them is stable A **technique** is a class of behaviour — reading credential material out of the memory of the Windows process that holds it, catalogued as `T1003.001`. A **procedure** is one specific way of carrying that behaviour out. A **tool** is one implementation of a procedure, with a filename, a hash and a signing certificate. These three levels decay at wildly different rates. A hash changes when a byte changes. A filename changes with a `copy` command. A procedure changes when someone writes new code. The technique — that credential material lives in that process's memory and something must read it — does not change at all until the platform changes. "Technique over tool" is the instruction to pin your hunt to the layer the adversary cannot cheaply move. ## The expansion exercise The first real work of a hunt on this technique is not a query, it is a list. Sit down with public technique documentation, incident reports, the readmes of open-source offensive tooling, and whatever your own red team uses, and write out the procedures: - `rundll32` calling the `MiniDump` export inside `comsvcs.dll` — a Microsoft-signed DLL already on the host, so nothing new is dropped. - A dedicated dumping utility, frequently a legitimately signed one, copied in under any name at all. - A bespoke implant calling `MiniDumpWriteDump` in-process, sometimes issuing the underlying syscalls directly to sidestep user-mode API hooks. - A **bring-your-own-vulnerable-driver** read: load a signed but flawed driver and have it read the target's memory from kernel mode. - Snapshotting or forking the process and dumping the clone, so the read that matters lands on a child object rather than on `lsass.exe`. - Persuading the operating system to write the dump for you through an error-reporting or crash-dump path. That list is the deliverable. It is longer than most people expect, and its length is exactly the point: a hunt for one filename covers one row of it. ## Finding the invariant Now read the list column-wise and ask what the variants share. Every user-mode variant on that list — the `comsvcs` one, the renamed utility, the direct-syscall implant, the snapshot — has to obtain a **handle to the target process with memory-read rights** before it can read anything. It cannot skip that step, because that is how the operating system arbitrates cross-process memory access. That is an invariant, and it is what you hunt: process-access telemetry where the target is the credential process and the granted access mask includes read rights. One query written against that invariant covers most of the list at once. It does not cover the kernel-driver variant, because a driver reading memory from kernel mode never asks for a user-mode handle, and it may not cleanly cover the clone variant, because the target image of the read is no longer the process you filtered on. Those become **separately named gaps** with their own observables — driver-load and service-creation records for the first, the dump file appearing on disk for the second — rather than silent holes you never noticed. ## Bank the list as a hunt asset The variant list, annotated per row with *which record would show this*, *does this estate collect that record*, and *is this variant hunted or actually detected*, outlives the hunt. Re-running the sweep next quarter becomes an hour instead of a day, a new published variant becomes one added row, and the annotations are the honest input to any coverage discussion. ## What this does not mean It does not mean artefacts are worthless. A sweep for a known dumping utility's name or hash is cheap to run, and a hit on it is high-confidence and immediately actionable. Run it — as a supplement. The error is arithmetic, not moral: counting that sweep as coverage of the technique, when it covers one procedure performed by one careless operator. It also does not mean every credential-access problem is this technique. Pulling the same secrets from a domain controller's directory database, or from a password manager, is a different technique with a different variant list and a different hunt. Expand the technique you actually chose; do not let the list sprawl into everything an intruder might do with a credential. ## The direction of the claim One last discipline, because it is where junior candidates trip. Finding no hits for your tool-name sweep tells you that this tool, under this name, was not seen in the records you searched. It says nothing about the other five procedures, nothing about hosts that were not reporting, and nothing about the period beyond your retention. State the claim as narrowly as the evidence supports it.