CrowdStrike Falcon Query LSASS access

event_simpleName=ProcessRollup2 ImageFileName=/lsass\.exe/

Falcon LogScale (CrowdStrike) query that detects processes whose binary is lsass.exe, the signature of a dump or process impersonation.

Run it in Falcon LogScale when you have the CrowdStrike sensor deployed and want to detect credential dumping attempts via the binary. The pattern is twofold: a process running as lsass.exe from a path other than C:\Windows\System32 (impersonation, used by tools like Shtinkering or modified dumping versions), or a legitimate lsass.exe process with anomalous behavior. The base query with ImageFileName filtered by lsass.exe gives you the inventory of executions; extending it with the path name separates legitimate from suspicious. In an environment where nobody runs lsass manually, any hit is worth investigating.

Do not use it as a standalone detection: classic LSASS dumping does not execute a new lsass.exe — it opens a handle on the already running process, and that is seen by Sysmon Event 10 or the sensor with process telemetry, not by an ImageFileName filter. This query hunts impersonation and dumps that create a process with that name, which are the minority of attacks. And watch out for false positives in environments with security software that loads DLLs into lsass: review the ParentImage before escalating the alert. For real coverage, combine it with the sensor's process access detection (the handle telemetry that CrowdStrike exposes as access events).