## Exercise: Credential Dumping (T1003)

**Objective**: Detect extraction of passwords from memory.

### The Attack (Atomic T1003.001)
*   **Command**: `procdump -ma lsass.exe lsass_dump.dmp`
*   **Context**: `lsass.exe` (Local Security Authority Subsystem Service) holds active credentials in RAM.
*   **Tool**: Sysinternals ProcDump (legitimate Microsoft tool).

### The Detection
1.  **Process Name**: `procdump.exe` or `procdump64.exe`.
2.  **Target Process**: `lsass.exe`.
3.  **Command Line**: Contains `lsass`.

### SIEM Search (Splunk)
`index=windows EventCode=10 TargetImage="*lsass.exe" GrantedAccess="0x1F0FFF"`
(Event 10 is Process Access. 0x1F0FFF is Full Access).

### The Fix
If you missed it:
1.  Install Sysmon.
2.  Configure Sysmon to log Event ID 10 for Target `lsass.exe`.
3.  Ingest logs.