Detectionhightest

Process Access via TrolleyExpress Exclusion

Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Thu Feb 10Updated Fri May 134c0aaedc-154c-4427-ada0-d80ef9c9deb6windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains:
      # We assume that the lsass.exe process has a process ID that's between 700 and 999 and the dumper uses just the PID as parameter
            - '\TrolleyExpress 7'
            - '\TrolleyExpress 8'
            - '\TrolleyExpress 9'
            - '\TrolleyExpress.exe 7'
            - '\TrolleyExpress.exe 8'
            - '\TrolleyExpress.exe 9'
      # Common dumpers
            - '\TrolleyExpress.exe -ma '
    renamed:
        Image|endswith: '\TrolleyExpress.exe'
    filter_renamed:
        OriginalFileName|contains: 'CtxInstall'
    filter_empty:
        OriginalFileName: null
    condition: selection or ( renamed and not 1 of filter* )