Once an attacker gains execution on a Windows system, credential access and lateral movement can become the next objectives. Monitoring well-known credential-dumping and remote-execution behaviors can help identify this transition.

The source defines a single process-creation hunt that combines command-line indicators with known executable names.

Credential Access Indicators

The query searches for strings associated with:

• sekurlsa;

• lsadump;

• comsvcs.dll MiniDump;

• ProcDump targeting LSASS;

• registry export of SAM and SYSTEM.

It also checks for execution of mimikatz.exe.

Lateral Movement Indicators

The same query includes:

• PsExec;

• PAExec;

• WMI /node;

• Win32_Process creation.

These can be used for legitimate administration, but they are also important lateral-movement behaviors when they appear unexpectedly.

Detection Query

data.win.system.eventID:1 and (data.win.eventdata.commandLine:(*sekurlsa* or *lsadump* or *comsvcs.dll*MiniDump* or *procdump*lsass* or *reg*save*HKLM\SAM* or *reg*save*HKLM\SYSTEM* or *psexec* or *wmic*/node* or *Win32_Process*Create*) or data.win.eventdata.image:(*\mimikatz.exe or *\psexec.exe or *\paexec.exe))

The source recorded three matching events during the previous 30 days.

Why Low-Volume Results Deserve Attention

Compared with broader process hunts, three events are a small number. That makes manual review practical and worthwhile.

Each event should be treated as a lead rather than an automatic incident. PsExec and WMI may be legitimate management tools, while credential-dumping commands generally require stronger justification.

Investigation Workflow

Review:

• exact command line;

• initiating user;

• parent process;

• remote target if present;

• source and destination hosts;

• authentication events;

• file hashes;

• security product alerts.

If LSASS access or registry hive export appears after suspicious exploitation activity, the event should be escalated quickly.

Correlation Opportunities

Credential access is especially meaningful when it follows:

• browser exploitation;

• server-side RCE;

• SYSTEM privilege escalation;

• defense evasion.

Likewise, PsExec or WMI usage shortly after credential dumping may indicate movement to additional systems.

Tuning

Approved administrative use of PsExec or WMI should be documented using known accounts, systems, and management infrastructure.

Avoid globally excluding these tools because their use outside the approved pattern remains valuable.

Operational Value

This detection combines several high-value post-exploitation behaviors into a compact hunt.

Because the source recorded only three matches, it can provide a manageable review queue and a strong opportunity to identify credential theft or unauthorized remote execution.