osquery process list credential dumping

SELECT * FROM processes WHERE cmdline LIKE '%lsass%'

Osquery query on the processes table to find processes related to lsass, credential dumping, or attack tools.

Run it when you have osquery deployed (or Fleet/Kolide centralizing agents) and want a quick sweep of endpoints looking for credential dumping activity. The base query looks at the command line of all processes: you'll find procdump with -ma lsass, comsvcs.dll with MiniDump, or binaries with suggestive names. Extending it with name and path, you also catch spoofing (a process named lsass.exe outside System32). With Fleet, the same query is launched across the entire fleet at once, and the aggregated result tells you which host has the anomaly — that's distributed hunting without installing anything new.

Don't use it as real-time detection: osquery is a snapshot — if the process has already ended (dumps usually last seconds), you won't see it. That's what Sysmon Event 10 or the EDR is for. It also doesn't work if the command line is obfuscated (arguments with broken quotes or in-memory loads): the query depends on the visible cmdline. And be careful with performance in large fleets: a SELECT * on processes across all endpoints at once is expensive; limit the query to the fields you need (name, path, cmdline) and schedule it as a scheduled query instead of ad-hoc.