LSASS Memory Credential Dumping: Mimikatz, Alternative Tools, and Protection Technologies

Scope: This section covers only live LSASS memory dump detection. DCSync (T1003.006), Kerberoasting (T1558.003), cloud PRT/OAuth (T1528), and browser session (T1539) are outside this section's scope. Each requires a separate detection package.

Prerequisite: Sysmon EID 10 (ProcessAccess) must be configured for lsass.exe. Without this configuration, the vast majority of the rules below will not work.

Detection Philosophy: Tool or Technique?

Core thesis: Properly configured EID 10 + GrantedAccess + CallTrace + correlation catches Mimikatz, ProcDump, comsvcs.dll, nanodump, and unknown custom dumpers with the same logic. Tool detection complements technique detection — it does not replace it.

Sysmon note: The GrantedAccess value is logged as a literal string; it is not bitwise-normalized. 0x1FFFFF and 0x1fffff may be different strings for Sysmon — case-insensitive matching or normalization is required in rules.

Four-Layer Detection Framework

Deployment order: K0 → K1 (with whitelist) → K2 → K3 → K4. Pilot order: DR-LSASS-1b / 2 / 3 → DR-LSASS-4 / 5 → DR-LSASS-7 / 8 / 9 → DR-LSASS-10 → DR-LSASS-6.

K0 — Prerequisite: Sysmon and ASR Telemetry

Sysmon ProcessAccess (EID 10) Configuration

<!-- sysmon-config.xml — lsass.exe access mask filter -->
<!-- Whitelist should be expanded per environment -->
<ProcessAccess onmatch="include">
  <Rule groupRelation="and">
    <TargetImage condition="end with">\lsass.exe</TargetImage>
    <GrantedAccess condition="contains any">
      0x40;0x1000;0x1010;0x1038;0x1400;0x1410;0x1438;0x143a;
      0x1440;0x120089;0x1f0fff;0x1f1fff;0x1f2fff;0x1f3fff;0x1fffff
    </GrantedAccess>
  </Rule>
</ProcessAccess>

0x1400 warning: This mask alone generates very high FP. Either remove it from the config, or make it mandatory to match with CallTrace in K1 rules. Do not leave inconsistency between the two. 0x1400 = Query Information + Limited Query Information

Microsoft Defender ASR Telemetry

Even when Credential Guard or RunAsPPL is active, these events can produce bypass attempt signals — include them in hunting scope.

K1 — EID 10 (ProcessAccess): The Main Lever

Every tool performing a live LSASS dump, regardless of technique, must make an OpenProcess(lsass) or equivalent call. Some advanced evasion paths (handle duplication, forking) pass through a different process or handle.

GrantedAccess Masks — Reference Table

Evaluate masks as score components, not as tool signatures. The same tool may produce different masks across different OS versions.

CallTrace Enrichment

The CallTrace field in EID 10 records the usermode call stack. Strong distinguishing signals:

• dbghelp.dll, dbgcore.dll → MiniDumpWriteDump chain

• |UNKNOWN( → reflective loading / direct syscall / spoofed stack

Important limitation: CallTrace spoofing is possible (WithSecure research, nanodump --spoof-callstack). Because the GrantedAccess mask is recorded by the kernel, it cannot be spoofed — rules relying on CallTrace alone are weak; use it together with GrantedAccess.

DR-LSASS-1 — LSASS Suspicious ProcessAccess (Primary)

• Severity: Medium (alone) — escalates with correlation

• FP: EDR, AV, backup agent, WMI (environment whitelist mandatory)

• Technique: T1003.001

title: LSASS Memory Access with Suspicious GrantedAccess
id: dr-lsass-001
status: experimental
description: >
  Detects access to the lsass.exe process with GrantedAccess masks
  typical for credential dumping. Legitimate EDR/AV processes must be whitelisted.
logsource:
  product: windows
  category: process_access
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1038'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1440'
      - '0x120089'
      - '0x1f1fff'
      - '0x1f3fff'
      - '0x1fffff'
      - '0x0040'
  filter_known_legit:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\MsSense.exe'
      - '\wininit.exe'
      - '\csrss.exe'
      - '\services.exe'
      - '\lsass.exe'
      - '\WerFault.exe'
      - '\WerFaultSecure.exe'
      # ENVIRONMENT: EDR agent, backup agent, SCCM — add from baseline
  condition: selection and not filter_known_legit
falsepositives:
  - EDR, antivirus, backup agents legitimately access LSASS
  - Environment-specific whitelist must be expanded (SourceImage + signature verification)
level: medium
tags:
  - attack.credential_access
  - attack.t1003.001

DR-LSASS-1b — CallTrace Strengthened (High Confidence)

• Severity: High

• FP: Much lower compared to DR-LSASS-1

• Note: 0x1400 is not included in this rule. FP is very high without the CallTrace combination.

title: LSASS Access with MiniDump CallTrace
id: dr-lsass-001b
status: experimental
description: >
  Detects suspicious GrantedAccess masks together with CallTrace pointing
  to the MiniDumpWriteDump chain. High-confidence variant of DR-LSASS-1.
logsource:
  product: windows
  category: process_access
detection:
  selection_mask:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1f1fff'
      - '0x1f3fff'
      - '0x1fffff'
  selection_trace:
    CallTrace|contains:
      - 'dbghelp.dll'
      - 'dbgcore.dll'
  filter_known_legit:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\MsSense.exe'
  condition: (selection_mask and selection_trace) and not filter_known_legit
falsepositives:
  - Debugging tools (legitimate developer environments)
level: high
tags:
  - attack.credential_access
  - attack.t1003.001

DR-LSASS-2 — comsvcs.dll ProcessAccess

• Severity: High

• Reference: SigmaHQ a49fa4d5-11db-418c-8473-1e014a8dd462

title: LSASS Memory Dump via comsvcs.dll
id: dr-lsass-002
status: test
description: >
  Detects rundll32.exe opening ProcessAccess to lsass.exe via comsvcs.dll.
  comsvcs.dll appearing in CallTrace is a strong signal.
logsource:
  product: windows
  category: process_access
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    SourceImage|endswith: '\rundll32.exe'
    CallTrace|contains: 'comsvcs.dll'
  condition: selection
falsepositives:
  - Very rare; legitimate comsvcs+lsass combination is not expected
level: high
tags:
  - attack.credential_access
  - attack.t1003.001

DR-LSASS-3 — comsvcs.dll ProcessCreate (Including Ordinal Obfuscation)

• Severity: High

• Reference: SigmaHQ 646ea171-dded-4578-8a4d-65e9822892e3

• Note: Obfuscation with ordinal notation (#24, #+000024, 65560) instead of MiniDump is also covered.

title: Process Memory Dump via comsvcs.dll (Ordinal Obfuscation Included)
id: dr-lsass-003
status: test
description: >
  Detects the rundll32.exe + comsvcs.dll + MiniDump combination.
  Obfuscation variants with ordinals (#24, 65560) are also included.
logsource:
  product: windows
  category: process_creation
detection:
  selection_img_name:
    Image|endswith: '\rundll32.exe'
  selection_img_orig:
    OriginalFileName: 'RUNDLL32.EXE'
  selection_cli:
    CommandLine|contains|all:
      - 'comsvcs'
      - 'full'
    CommandLine|contains:
      - 'MiniDump'
      - 'Minidump'
      - '#24'
      - '#-'
      - '#+'
      - '#65560'
      - '65560'
  condition: (selection_img_name or selection_img_orig) and selection_cli
falsepositives:
  - Legitimate use is virtually nonexistent
level: high
tags:
  - attack.credential_access
  - attack.t1003.001

K2 — Correlation (High Confidence)

DR-LSASS-4 — comsvcs.dll Full Chain (EID 1 + 10 + 11)

• Severity: Critical

• Platform: Sigma (time correlation — SIEM-specific implementation required)

• Logic: Within a 60-second window: EID 1 (rundll32+comsvcs) → EID 10 (lsass access) → EID 11 (.dmp creation)

title: comsvcs.dll LSASS Dump — Full Chain Correlation
id: dr-lsass-004
status: experimental
description: >
  Detects the chain of rundll32+comsvcs ProcessCreate, followed by lsass.exe
  ProcessAccess and .dmp FileCreate within 60 seconds.
  Must be implemented with time correlation in the platform SIEM.
  NOTE: Time correlation does not fit Sigma's official model;
  this rule should be used as a reference for conversion to a SIEM-native query.
  Join key: ProcessGuid / SourceProcessGUID + DeviceId + 60s window.
logsource:
  product: windows
  category: process_creation   # EID 1 anchor
detection:
  selection_proc:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains|all:
      - 'comsvcs'
    CommandLine|contains:
      - 'MiniDump'
      - '#24'
      - '65560'
  # EID 10 and EID 11 must be added as additional tables in SIEM correlation:
  # EID 10: SourceProcessGUID == proc.ProcessGuid AND TargetImage endswith lsass.exe
  # EID 11: InitiatingProcessGuid == proc.ProcessGuid AND TargetFilename endswith .dmp
  # Time window: 60 seconds
  condition: selection_proc
falsepositives:
  - Virtually nonexistent; all three stages of the chain must trigger
level: critical
tags:
  - attack.credential_access
  - attack.t1003.001

DR-LSASS-5 — Silent Process Exit / WerFault LSASS Dump

5a — Registry (IFEO / SilentProcessExit)

• Severity: High

• Note: GlobalFlag 0x200 alone is not sufficient; several PoCs use 0x214 (IFEO + heap tracking combination). contains: '0x200' also catches 0x214 — this behavior is intentional.

title: Silent Process Exit / IFEO Abuse Configured for LSASS
id: dr-lsass-005a
status: experimental
description: >
  Silent Process Exit (SPE) or IFEO configuration abuse for LSASS.
  This is an attack preparation signal. Not classified as an incident on its own.
  Verify with: DR-LSASS-5b (WerFault .dmp) and/or EID 1 + EID 10 + EID 11 (60s window).
logsource:
  product: windows
  category: registry_event
detection:
  # --- IFEO: Silent Process Exit monitor flag ---
  selection_ifeo_globalflag:
    TargetObject|contains: '\Image File Execution Options\lsass.exe'
    TargetObject|endswith: '\GlobalFlag'
    Details|contains:
      - '0x200'
      - '0x0200'
      - '0x00000200'
      - '0x214'
      - '0x00000214'
      - 'DWORD (200)'
      - 'DWORD (512)'
      - 'DWORD (0x200)'
      - 'DWORD (0x214)'
  # --- IFEO: Debugger (execution hijack) ---
  selection_ifeo_debugger:
    TargetObject|contains: '\Image File Execution Options\lsass.exe'
    TargetObject|endswith: '\Debugger'
    Details|contains: '\'
  # --- SPE: dump intent ---
  selection_spe_dump_intent:
    TargetObject|contains: '\SilentProcessExit\lsass.exe'
    TargetObject|endswith:
      - '\ReportingMode'
      - '\LocalDumpFolder'
      - '\DumpType'
  # --- SPE: execution chain ---
  selection_spe_exec_chain:
    TargetObject|contains: '\SilentProcessExit\lsass.exe'
    TargetObject|endswith:
      - '\MonitorProcess'
      - '\Debugger'
  condition: 1 of selection_*
falsepositives:
  - Intentional debug/test environment (separate OU / test GPO)
  - EDR or crash analytics vendor tooling (signed binary + change ticket)
  - Genuine LSASS crash root-cause analysis (correlated with WER + crash telemetry)
  - Whitelist: SourceImage/signature + target OU + change record (CMDB ticket)
level: high
tags:
  - attack.credential_access

5b — WerFault LSASS Dump File

• Reference: SigmaHQ c3e76af5-4ce0-4a14-9c9a-25ceb8fda182

• Note: In a RunAsPPL environment, WerFault may not be able to produce a successful dump, but the attempt signal is still generated.

title: WerFault LSASS Process Memory Dump
id: dr-lsass-005b
status: test
description: >
  Detects WerFault.exe creating a dump file belonging to lsass.exe.
  A dump triggered without LSASS crashing (Silent Process Exit method) is a high-confidence signal.
  May produce FN if a custom WER path has been configured:
  HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps should be checked.
logsource:
  product: windows
  category: file_event
detection:
  selection_process:
    Image|endswith:
      - '\WerFault.exe'
      - '\WerFaultSecure.exe'
  selection_dump_any:
    TargetFilename|contains|all:
      - 'lsass'
      - '.dmp'
  selection_dump_wer_canonical:    # Note for correlation
    TargetFilename|re: '\\lsass(\.exe)?\..+\.dmp$'
  condition: selection_process and selection_dump_any
level: high

DR-LSASS-6 — Post-Dump Lateral Movement Pointer

• Severity: High

• Logic: Multiple Type 3 network logons from the same host within 15 minutes after LSASS access.

• Implementation note: EID 10 must be pulled from the Sysmon table and EID 4624 from the Windows Security table. These are different log sources; they must be joined using union or a platform-native join. The threshold (LogonCount ≥ 5) must be calibrated after baselining.

title: Post-LSASS-Access Lateral Movement Indicator
id: dr-lsass-006
status: experimental
description: >
  Detection of numerous Type 3 (network) logons from the same host within
  15 minutes of an lsass.exe ProcessAccess event.
  This rule requires joining two different log sources (Sysmon EID 10 + Windows Security EID 4624)
  in the SIEM.
  Threshold (LogonCount >= 5, 15 minutes) must be calibrated against the environment baseline.
logsource:
  product: windows
  category: process_access   # Anchor: Sysmon EID 10
detection:
  selection_anchor:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1fffff'
      - '0x1f3fff'
      - '0x1438'
  # Correlation layer (SIEM-native join):
  # Windows Security EID 4624, LogonType=3, same host, 0-15 min window
  # Threshold: >=5 distinct targets → hunt; >=10 → critical
  condition: selection_anchor
falsepositives:
  - FP may be high in environments with heavy network logons (baseline mandatory)
  - Security scans, authentication testing tools
level: high
tags:
  - attack.credential_access
  - attack.t1003.001
  - attack.lateral_movement
  - attack.t1550.002

K3 — Bypass and Kernel Signals

DR-LSASS-7 — HandleKatz Handle Duplication

• Severity: High

• Reference: SigmaHQ b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5

• Note: HandleKatz sometimes does not generate a direct EID 10 against LSASS; access may be seen on another process holding a LSASS handle.

title: Suspicious LSASS Access via Handle Duplication (HandleKatz/Nanodump)
id: dr-lsass-007
status: experimental
description: >
  Detects process access attempts on LSASS made from UNKNOWN memory.
  HandleKatz, Nanodump, and similar tools make calls from unsigned (reflective)
  regions when stealing handles via NtDuplicateObject. The UNKNOWN segment
  in CallTrace is a strong anomaly signal.
logsource:
  product: windows
  category: process_access
detection:
  selection_target:
    TargetImage|endswith: '\lsass.exe'
    CallTrace|contains: '|UNKNOWN'
  selection_access:
    GrantedAccess|contains:
      - '0x1440'
      - '0x1fffff'
      - '0x143a'
      - '0x0410'
      - '0x1410'
  filter_legit:
    SourceImage|contains:
      - '\procexp'
      - '\procexp64'
      - '\MsMpEng.exe'
  condition: selection_target and selection_access and not filter_legit
falsepositives:
  - Process Explorer and Sysinternals tools (largely blocked by filter)
  - Some EDR/AV products may generate similar traces in their own LSASS access
  - Application compatibility layer (shim) can rarely produce UNKNOWN segments
level: high
tags:
  - attack.credential_access
  - attack.t1003.001
  - attack.t1055

DR-LSASS-7b — MirrorDump (Reverse Direction — SourceImage=lsass.exe)

• Severity: High

• Note: The MirrorDump technique causes LSASS to access another process as the source — standard TargetImage=lsass rules miss this pattern.

title: Potential MirrorDump - LSASS as Source with Suspicious Handle Access
id: dr-lsass-007b
status: experimental
description: >
  Detects LSASS accessing another process as the source process (SourceImage)
  from UNKNOWN memory.
  Standard TargetImage=lsass rules miss this reverse-direction pattern.
logsource:
  product: windows
  category: process_access
detection:
  selection:
    SourceImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x0040'
      - '0x0010'
      - '0x1010'
      - '0x1fffff'
    CallTrace|contains: '|UNKNOWN'
  filter_legit:
    TargetImage|contains:
      - '\svchost.exe'
      - '\winlogon.exe'
      - '\csrss.exe'
      - '\services.exe'
  filter_self_access:
    TargetImage|endswith: '\lsass.exe'
  condition: selection and not filter_legit and not filter_self_access
falsepositives:
  - Unknown legitimate system processes may receive handles from LSASS
  - Some EDR products may trigger this pattern
level: high
tags:
  - attack.credential_access
  - attack.t1003.001

DR-LSASS-8 — Kernel Driver Load + LSASS Access (BYOVD / mimidrv)

• Severity: Critical

• Logic: Suspicious driver loading (EID 6 / 7045) followed by LSASS access within 15 minutes.

• Additional: Microsoft Vulnerable Driver Blocklist violations and known BYOVD drivers (RTCore64, DBUtil, gdrv, aswArPot, etc.) should also be monitored separately by signature and behavior.

title: Suspicious Driver Load Followed by LSASS Access (BYOVD / mimidrv)
id: dr-lsass-008
status: experimental
description: >
  Detection of LSASS access after an unexpected driver loading (EID 6 / 7045).
  This is the primary signal of a RunAsPPL bypass attempt.
  Two log sources (EID 6 + EID 10) must be combined in the SIEM with time correlation.
  The Microsoft Vulnerable Driver Blocklist should be referenced for known BYOVD drivers.
  WARNING: The Company field may not be populated in all Sysmon versions;
  filter_legit must be validated in the environment.
  WARNING: Signed vulnerable drivers (gdrv.sys, aswArPot.sys, etc.)
  may evade the Company filter — keep blocklist hashes current.
logsource:
  product: windows
  category: driver_load
detection:
  selection_known_byovd_name:
    ImageLoaded|endswith:
      - '\RTCore64.sys'
      - '\mhyprot2.sys'
      - '\mimidrv.sys'
      - '\DBUtil_2_3.sys'
      - '\zamguard64.sys'
      - '\gdrv.sys'
      - '\aswArPot.sys'
      # Expand from Microsoft Vulnerable Driver Blocklist
  selection_unsigned:
    Signed: 'false'
    ImageLoaded|startswith:
      - 'C:\Windows\'
      - 'C:\Program Files\'
  filter_legit:
    ImageLoaded|startswith:
      - 'C:\Windows\System32\drivers\'
      - 'C:\Windows\SysWOW64\drivers\'
    Signed: 'true'
    Company|contains:
      - 'Microsoft'
      - 'Intel'
      - 'NVIDIA'
      - 'AMD'
  condition: selection_known_byovd_name or (selection_unsigned and not filter_legit)
falsepositives:
  - Signed but vulnerable drivers not in the name list may evade — keep blocklist current
  - New hardware driver installation (may fall outside Company filter scope)
  - filter_legit does not work for Sysmon events with empty Company field — FP may increase
level: critical
tags:
  - attack.credential_access
  - attack.t1003.001
  - attack.defense_evasion
  - attack.t1068
  - attack.t1014

DR-LSASS-9 — Process Forking (nanodump --fork / RtlCreateProcessReflection)

• Severity: High

• Note: After forking, the dump occurs against the clone PID — TargetImage=lsass.exe rules miss access made to this clone. This rule detects at the creation layer.

title: Suspicious Child Process Spawned by LSASS
id: dr-lsass-009
status: experimental
description: >
  Detects lsass.exe spawning an unexpected child process.
  This is the primary signal of the nanodump --fork
  (RtlCreateProcessReflection / PssNtCaptureSnapshot) technique.
  After forking, the dump targets the clone PID;
  TargetImage=lsass rules miss this pattern.
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\lsass.exe'
  filter_legit:
    Image|endswith:
      - '\werfault.exe'
      - '\werfaultsecure.exe'
      - '\conhost.exe'
  condition: selection and not filter_legit
falsepositives:
  - EDR/AV products may create injected processes under LSASS; expand filter_legit per environment
  - conhost.exe may appear as an LSASS child on some Windows versions
level: high
tags:
  - attack.credential_access
  - attack.t1003.001

K4 — Registry and Configuration Manipulation

DR-LSASS-10a — WDigest Plaintext Enablement

• Severity: High

• Technique: T1003.001

title: WDigest UseLogonCredential Enabled
id: dr-lsass-010a
status: experimental
description: >
  Detects enabling of WDigest plaintext password caching.
  On Win 8.1+ systems this value is absent or 0 by default.
  An unexpected UseLogonCredential=1 assignment is an attack indicator.
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: '\WDigest\UseLogonCredential'
    Details|endswith:
      - '0x00000001'
      - 'DWORD (0x00000001)'
  condition: selection
falsepositives:
  - Intentional administrator configuration (very rare; must be documented)
level: high
tags:
  - attack.credential_access
  - attack.t1003.001

DR-LSASS-10b — RunAsPPL Disabled

• Severity: High

• Technique: T1562.001 (Defense Evasion)

title: RunAsPPL Disabled via Registry
id: dr-lsass-010b
status: experimental
description: >
  Detects LSA protection (RunAsPPL) being disabled via the registry.
  Without a UEFI lock, this change + a reboot achieves a PPL bypass.
  The identity of the process making this change must be investigated.
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: '\Control\Lsa\RunAsPPL'
    Details|endswith:
      - '0x00000000'
      - 'DWORD (0x00000000)'
  selection_deleted:
    TargetObject|endswith: '\Control\Lsa\RunAsPPL'
    Details: '(Empty)'
  condition: selection or selection_deleted
falsepositives:
  - Intentional system administrator change (must be verified with change management record)
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.001

Other Sysmon Signals — Priority Table

Tool Detection — Low-Cost First Gate (Complementary)

Known signatures via EID 1 / 4688. Trivially bypassed by renaming or fileless execution; does not replace technique detection — complements it.

sekurlsa::       lsadump::       privilege::debug
p::d             s::l            mimidrv.sys
-ma lsass        procdump + lsass
createdump       rdrleakdiag     fullmemdmp

Modern Evasion — Detection Arms Race

WDigest memory patch note: Patching g_fParameter_UseLogonCredential and g_IsCredGuardEnabled directly in LSASS memory cannot be detected. The reliable way to catch this attack is EDR telemetry based on kernel callbacks or memory integrity scanning — Sysmon does not cover this gap.

ETW Threat Intelligence: Modern EDRs use ETW-TI for ReadVirtualMemory, handle duplication, and similar operations. In Sysmon-only SOCs, the protection layers in Section 2 (Credential Guard, RunAsPPL) should be counted as an indirect part of detection — if protection fails, a signal is generated.

Non-LSASS Credential Surface (Brief Map)

These rules are outside the T1003.001 scope; each requires a separate detection package.

DCSync GUID Reference (T1003.006)

Monitored with EID 4662. Pay attention to GUID notation — ending bb49 is correct, ending bcd2 is a typo that kills the rule.

False Positive Management

1. Run in audit mode for the first 2 weeks — baseline which SourceImages access LSASS with which masks.

2. Create a whitelist: EDR agent, AV engine, backup agent, SCCM, WMI (WmiPrvSE.exe must be handled carefully).

3. Distinguish legitimate dbghelp usage with CallTrace — debuggers on developer machines may produce legitimate dumps.

4. Apply the ASR audit → whitelist → block sequence.

5. Thresholds (time-based rules such as DR-LSASS-6) must be calibrated with P95 + 2σ discipline.

MITRE ATT&CK Mapping

Realistic Expectations

The goal of detection is to eliminate the attacker's free movement space — not perfect visibility. Each layer introduces additional cost and noise; each rule must have its own FP budget.

Even in environments with Credential Guard and RunAsPPL active, bypass attempts generate signals. "Protection exists → detection is unnecessary" is wrong; when protection fails, detection is the last line of defense.

Production / import note: Single-event rules → Sigma. Rules requiring time correlation (DR-LSASS-4, 6, 8) → must be converted to SIEM-native queries; thresholds and whitelists must not be hardcoded into the rule — they should be kept in an environment parameter table.