Windows Application Error: LSASS (lsass.exe) Crash Events (Event ID 1000)

title: "Windows Application Error: LSASS (lsass.exe) Crash Events (Event ID 1000)"
id: 04cbf1ce-6af3-441e-bd43-74234052beec
status: experimental
description: This rule flags Windows Application Error (Event ID 1000) records where the crashed application is lsass.exe. A crash of LSASS is security-relevant because it may indicate intentional disruption or an attempt to interfere with credential-handling components. It relies on Application event telemetry capturing Provider_Name, AppName, and ExceptionCode values associated with the failure.
references:
  - https://github.com/deepinstinct/Lsass-Shtinkering
  - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/application_error/win_application_error_lsass_crash.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-07
modified: 2025-12-03
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    EventID: 1000
    AppName: lsass.exe
    ExceptionCode: c0000001
  condition: selection
falsepositives:
  - Rare legitimate crashing of the lsass process
level: high
license: DRL-1.1
related:
  - id: a18e0862-127b-43ca-be12-1a542c75c7c5
    type: derived