huntrule

Windows WerFault creates dump files referencing LSASS process memory

Flags WerFault dump creation where the dump filename suggests it contains LSASS memory.

FreeUnreviewedSigmahighv1
title: Windows WerFault creates dump files referencing LSASS process memory
id: 7ae989b0-b6f6-4270-9799-9099a7d3724e
status: test
description: This rule identifies executions of WerFault.exe that create a dump file whose name contains references to lsass or lsass.exe. Dumping LSASS memory is a common step toward credential access because it may contain authentication material. It relies on Windows file creation telemetry to match the WerFault image path and target dump filename patterns.
references:
  - https://github.com/helpsystems/nanodump
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_lsass_werfault_dump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-27
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image: C:\WINDOWS\system32\WerFault.exe
    TargetFilename|contains:
      - \lsass
      - lsass.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c3e76af5-4ce0-4a14-9c9a-25ceb8fda182
    type: derived

What it detects

This rule identifies executions of WerFault.exe that create a dump file whose name contains references to lsass or lsass.exe. Dumping LSASS memory is a common step toward credential access because it may contain authentication material. It relies on Windows file creation telemetry to match the WerFault image path and target dump filename patterns.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.