Windows Registry: LSASS Full Dump via WER LocalDumps DumpType=2

title: "Windows Registry: LSASS Full Dump via WER LocalDumps DumpType=2"
id: 57041ba0-d780-47c9-a6e4-dcb533e2648e
status: test
description: This rule matches Windows registry updates where the DumpType value under Windows Error Reporting LocalDumps is set to a DWORD value of 0x00000002 (Full Dump) for the lsass.exe local dump configuration. Setting DumpType to 2 enables creation of full memory dumps of LSASS, which attackers can use to extract credentials from process memory. Detection relies on registry set telemetry capturing the TargetObject path and the Details value indicating a full dump setting.
references:
  - https://github.com/deepinstinct/Lsass-Shtinkering
  - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
  - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_lsass_usermode_dumping.yml
author: "@pbssubhash, Huntrule Team"
date: 2022-12-08
modified: 2023-08-17
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\DumpType
      - \SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\lsass.exe\DumpType
    Details: DWORD (0x00000002)
  condition: selection
falsepositives:
  - Legitimate application that needs to do a full dump of their process
level: high
license: DRL-1.1
related:
  - id: 33efc23c-6ea2-4503-8cfe-bdf82ce8f719
    type: derived