huntrule

Windows Application Error: LSASS (lsass.exe) Crashed (Event ID 1000)

Alerts on Application Error (Event ID 1000) entries where lsass.exe crashes, using Windows Application event telemetry.

FreeReviewedSigma · High · v2
Product
windows
Service
application
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-12-07
Updated
2026-07-31
AnalysisDetection
title: "Windows Application Error: LSASS (lsass.exe) Crashed (Event ID 1000)"
id: 04cbf1ce-6af3-441e-bd43-74234052beec
status: experimental
description: This rule flags Windows Application Error events (Event ID 1000) where the crashing application is lsass.exe with an exception code of c0000001. A crash in LSASS is security-relevant because it can be used to disrupt credential protections and facilitate credential access workflows. It relies on Windows Application Error telemetry that records the event provider, crashing application name, event ID, and exception code.
references:
  - https://github.com/deepinstinct/Lsass-Shtinkering
  - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/application_error/win_application_error_lsass_crash.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-07
modified: 2025-12-03
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    EventID: 1000
    AppName: lsass.exe
    ExceptionCode: c0000001
  condition: selection
falsepositives:
  - Rare legitimate crashing of the lsass process
level: high
license: DRL-1.1
related:
  - id: a18e0862-127b-43ca-be12-1a542c75c7c5
    type: derived