# Credential Dumping Investigation (lab)

> A detection engineer at a healthcare provider was rewriting the "process accessed LSASS" rule, muted months ago as unusable.

Canonical: https://codelivly.com/labs/credential-dumping

| | |
|---|---|
| Type | Investigation |
| Difficulty | Intermediate |
| Points | 300 |
| Session length | 45 min |
| Completions | 1 |

A detection engineer at a healthcare provider was rewriting the "process accessed LSASS" rule, muted months ago as unusable. Reviewing one day of raw telemetry they found a single event they could not account for. No alert fired, nothing was quarantined, and searching the estate for known credential-theft tooling by filename returns nothing.

## Objective

Learn why the first detection every SOC writes for credential theft is also the first one it mutes, and what to write instead. You will decode Windows access-rights bitmasks by hand, separate processes that merely queried a target from those that could read its memory, reason about which readers are legitimate, and recognise credential theft carried out entirely with signed operating-system binaries.

## Tasks

1. Read the brief, then measure the noise
2. Decode the access masks
3. Judge the survivors
4. Establish what it ran, and as whom
5. Find what it left behind, and map it

## Related

- [All labs](https://codelivly.com/practice?type=lab)