Windows WerFault Access to lsass.exe Indicative of Credential Dumping Attempts
Alert on WerFault.exe gaining broad access to lsass.exe, consistent with credential dumping attempts.
- Product
- windows
- Category
- process_access
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2012-06-27
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags when WerFault.exe requests broad access (GrantedAccess 0x1FFFFF) to lsass.exe, which can indicate an attempt to obtain sensitive credentials from LSASS. Attackers may leverage crash-dump workflows to capture process memory without direct user-mode dump tooling. The detection relies on process access telemetry, specifically the SourceImage path ending in WerFault.exe, the TargetImage path ending in lsass.exe, and the granted access rights value.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WerFault Access to lsass.exe Indicative of Credential Dumping Attempts
id: af2a2616-846c-40d5-80d1-d06b33e46ddb
status: test
description: This rule flags when WerFault.exe requests broad access (GrantedAccess 0x1FFFFF) to lsass.exe, which can indicate an attempt to obtain sensitive credentials from LSASS. Attackers may leverage crash-dump workflows to capture process memory without direct user-mode dump tooling. The detection relies on process access telemetry, specifically the SourceImage path ending in WerFault.exe, the TargetImage path ending in lsass.exe, and the granted access rights value.
references:
- https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_werfault.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2012-06-27
modified: 2023-11-29
tags:
- attack.credential-access
- attack.t1003.001
- attack.s0002
logsource:
category: process_access
product: windows
detection:
selection:
SourceImage|endswith: \WerFault.exe
TargetImage|endswith: \lsass.exe
GrantedAccess: "0x1FFFFF"
condition: selection
falsepositives:
- Actual failures in lsass.exe that trigger a crash dump (unlikely)
- Unknown cases in which WerFault accesses lsass.exe
level: high
license: DRL-1.1
related:
- id: e5b33f7d-eb93-48b6-9851-09e1e610b6d7
type: derived