Windows: LSASS crash dump (.dmp) present in CrashDumps directory

title: "Windows: LSASS crash dump (.dmp) present in CrashDumps directory"
id: a8c5944d-3fd8-499e-933d-c00c39ef927f
status: test
description: This rule flags file events where a dump file for lsass.exe is created in the Windows CrashDumps location under the systemprofile AppData path. A dump of the LSASS process can enable credential access by exposing sensitive in-memory data to an attacker. The detection relies on file telemetry that records TargetFilename along with prefix/substring/suffix matching for the .dmp artefact.
references:
  - https://github.com/deepinstinct/Lsass-Shtinkering
  - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lsass_shtinkering.yml
author: "@pbssubhash, Huntrule Team"
date: 2022-12-08
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|startswith: C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\
    TargetFilename|contains: lsass.exe.
    TargetFilename|endswith: .dmp
  condition: selection
falsepositives:
  - Rare legitimate dump of the process by the operating system due to a crash of lsass
level: high
license: DRL-1.1
related:
  - id: 6902955a-01b7-432c-b32a-6f5f81d8f625
    type: derived