Windows WerFault Triggered LSASS Access for Credential Dumping

Alert on WerFault.exe gaining broad access to lsass.exe, consistent with credential dumping attempts.

FreeUnreviewedSigmahighv1

windows-werfault-triggered-lsass-access-for-credential-dumping-e5b33f7d

title: Windows WerFault Triggered LSASS Access for Credential Dumping
id: af2a2616-846c-40d5-80d1-d06b33e46ddb
status: test
description: This rule flags process access where WerFault.exe attempts to access lsass.exe with broad granted permissions, which aligns with behavior used to obtain credential material. Attackers may leverage Windows error reporting components to interact with LSASS in order to create or facilitate memory dumps. It relies on Windows process access telemetry capturing SourceImage, TargetImage, and GrantedAccess for the interaction.
references:
  - https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_werfault.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2012-06-27
modified: 2023-11-29
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0002
logsource:
  category: process_access
  product: windows
detection:
  selection:
    SourceImage|endswith: \WerFault.exe
    TargetImage|endswith: \lsass.exe
    GrantedAccess: "0x1FFFFF"
  condition: selection
falsepositives:
  - Actual failures in lsass.exe that trigger a crash dump (unlikely)
  - Unknown cases in which WerFault accesses lsass.exe
level: high
license: DRL-1.1
related:
  - id: e5b33f7d-eb93-48b6-9851-09e1e610b6d7
    type: derived

What it detects

This rule flags process access where WerFault.exe attempts to access lsass.exe with broad granted permissions, which aligns with behavior used to obtain credential material. Attackers may leverage Windows error reporting components to interact with LSASS in order to create or facilitate memory dumps. It relies on Windows process access telemetry capturing SourceImage, TargetImage, and GrantedAccess for the interaction.

Known false positives

Actual failures in lsass.exe that trigger a crash dump (unlikely)
Unknown cases in which WerFault accesses lsass.exe

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.