procdump LSASS test

procdump.exe -accepteula -ma lsass.exe lsass.dmp

Dumps LSASS with procdump on the test host, validating detection of the dump using the legitimate tool (LOLBAS).

Run it in the purple team lab when you want to validate detection of the dump without signatures: procdump is the legitimate Sysinternals tool (signed) that attackers use to dump LSASS — signature-based detection won't catch it (it's legitimate), but behavior-based detection (access to lsass) will. It's the validation of the behavioral layer of credential dumping: Event 10 (GrantedAccess 0x1010), SIEM rules, EDR. In purple teaming, procdump validates that detection doesn't rely on malware signatures — dumping with a clean tool is the real living off the land scenario.

Don't run it outside the lab: dumping lsass generates real events — the test host is the place. And note: procdump is legitimate and signed — signature-based detection doesn't apply (expected result); the validation measures the behavioral layer (access to lsass with 0x1010) and procdump rules on lsass. A 'detected' result requires Sysmon Event 10 (or EDR with process telemetry): without telemetry, the procdump dump goes through. Clean up the dump (lsass.dmp) when done — the file contains lab credentials.