Detecting LSASS Credential Dumping with Sigma and ChatGPT

By Marco Gundlach Last updated on November 13, 2026

Imagine an attacker has gained access to a client via a phishing email and has been moving through the network unnoticed for hours. The decisive step comes when they read the credentials of logged-in users from the memory of the process lsass.exe. You need to detect exactly this moment before it turns into greater damage.

Play video from YouTube

The video is only loaded from YouTube when you play it – data (including your IP address) is then transmitted to YouTube/Google. More in the privacy policy

This guide shows you how to use Sigma to write a platform-independent detection rule for LSASS credential dumping, translate it with ChatGPT into the query languages of common SIEM systems, and then test and optimize it. The basis is the lesson "Detection Rule Engineering" from the course GenAI for Cybersecurity.

Key Takeaways

• Detection engineering means recognizing attacks based on behavior and traces before they cause damage.
• Sigma is a YAML-based rule language. You write the rule once and convert it for Splunk SPL, Microsoft Sentinel KQL, Elastic, QRadar, CrowdStrike, and other platforms.
• LSASS credential dumping corresponds to the MITRE ATT&CK technique T1003.001 (OS Credential Dumping: LSASS Memory).
• ChatGPT significantly speeds up drafting, conversion, and test planning, but it does not replace your own expert review.
• A rule is only usable once it has been checked with true positives, true negatives, edge cases, and load tests.

Step-by-Step Guide

Step 1: Understand Sigma as a common language

Before you generate code, you should know why Sigma makes sense. Sigma is an open, platform-independent description language for detection rules in YAML format. In it, you define which log source is relevant, which fields and values indicate an activity, and under what condition an alert should be triggered. The translation into the syntax of your target platform is then handled by a converter or, as in this lesson, by ChatGPT. The big advantage: your detection logic stays centrally maintained, regardless of whether your team works with Splunk, Sentinel, or QRadar tomorrow.

Step 2: Describe the attack scenario precisely

A good prompt starts with a clear goal. You want to detect the reading of the memory of lsass.exe, through which attackers obtain password hashes or Kerberos tickets. Typical tools for this are Mimikatz, Procdump, or the Task Manager, which can create a memory dump of the process. Therefore, include in the prompt the MITRE ATT&CK ID T1003.001, a short description of the attack technique, the desired detection approaches, and the requirement for the Sigma format. The more precisely you formulate it, the more usable the first version will be.

Step 3: Generate a Sigma rule with ChatGPT

After submitting, you receive several variants within seconds. Common approaches are evaluating Sysmon Event ID 10 (ProcessAccess), where the target process image points to lsass.exe, as well as checking for suspicious access rights or known tool names. A simple version could look like this:

title: LSASS Memory Access durch verdächtige Prozesse
status: experimental
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
    filter_legit:
        SourceImage|endswith:
            - '\MsMpEng.exe'
    condition: selection and not filter_legit
level: high
tags:
    - attack.credential_access
    - attack.t1003.001

Always check the generated code yourself. The structure is usually solid, but you need to adapt the field names and filters to your actual telemetry.

Step 4: Critically review the logic and the recommendations

Don't be fooled by a cleanly formatted rule. ChatGPT usually explains why the logic works, and you should be able to follow it. Check whether the log source is actually collected in your environment and whether the filters are not too broad. Pay particular attention to the practical recommendations: don't weaken the rule across the board, but specifically exclude legitimate security processes such as antivirus scanners or EDR agents, and document every exception. Otherwise, a watered-down rule will miss exactly the attacks it was written for.

Step 5: Convert the Sigma rule to Splunk SPL

Now you translate the rule into Splunk SPL. Paste the complete Sigma rule into a new chat and ask for a conversion to SPL. You get a search that you can copy directly into the Splunk search bar. Afterwards, add the details for index and sourcetype, because searches without this restriction are slow and unnecessarily broad. Then save the search as a saved search or correlation search with a schedule and alerting.

Step 6: Translate the Rule into KQL for Microsoft Sentinel

For Microsoft Sentinel, you formulate the prompt with specific requirements. Ask for KQL, name the tables, such as SecurityEvent or the Sysmon data, and request a let statement so that filters apply early and the query runs faster. Also request an Analytics Rule with entity mapping and MITRE mapping. The entity mapping ensures that host and account are cleanly linked in the incident. Paste the code into Log Analytics and check whether the query runs without syntax errors and returns results.

Step 7: Add a YARA Rule for File-Based Detection

Not every trace shows up in behavior. Mimikatz binaries or customized variants can also be detected based on static characteristics. For this, you create a YARA rule with known strings, byte patterns and, if possible, PE characteristics. Ask ChatGPT for several condition variants such as any of them or all of them, weighted strings, and complete metadata with description, reference and date. YARA is particularly suitable for scans on endpoints or in sandboxes and usefully complements the SIEM rules.

Step 8: Create a Test Plan

An untested rule is only a guess. Therefore, ask ChatGPT for a test plan with four areas: true positive tests that deliberately trigger attacks, true negative tests that must not fire during normal operation, edge cases, and a performance test. The plan contains scenarios, success criteria and tuning notes. Adopt it as the basis for your test log and record for each rule which tests you have carried out.

Step 9: Check True Positives and True Negatives

For true positives, a rule of thumb applies: at least nine out of ten deliberately triggered accesses to LSASS should generate an alert, and in every alert the host and the causing process must be visible. For true negatives in normal operation without an incident, the rule may only generate a few hits, and these must be explainable by security tools or known admin actions. Carry out the attack simulations exclusively in an isolated lab environment.

Step 10: Edge Cases, Performance and Tuning

Edge cases cover borderline cases, such as renamed tools, accesses via remote connections, or processes with unusual privileges. In the performance test, you check how much load the rule can handle at high log volume without overloading your SIEM. ChatGPT's tuning recommendations help you speed up searches, adjust time windows and formulate exceptions more precisely. Test every change again before you adopt it, because tuning can open up new gaps.

Step 11: Documentation, Versioning and Maintenance

Document each rule with a MITRE ATT&CK reference, test results and known false positives. Store the Sigma files in a Git repository. This is free and quick to set up, and you keep every change traceable. Also schedule regular reviews, because attack techniques and log formats change. New insights from incidents flow directly into the next iteration of your rules.

Summary – Detecting LSASS Credential Dumping: Developing Detection Rules with Sigma and ChatGPT

You have seen how an attack description becomes a unified Sigma rule, which you then translate into SPL, KQL and YARA. With a structured test plan, you check hit rate, false alarms, edge cases and load before the rule goes into production. ChatGPT does a lot of the groundwork here, but responsibility for logic, testing and approval remains with you. The next lesson continues with a Security Assessment, a deep dive into the penetration test report and the prioritization of findings.

Trainer About Marco Gundlach