Detection rules › Sigma

LSASS Process Dump Artefact In CrashDumps Folder

Severity
high
Author
@pbssubhash
Source
upstream

Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.001 OS Credential Dumping: LSASS Memory

Event coverage

ProviderEvent IDTitle
Sysmon11FileCreate

Stages and Predicates

Stage 1: selection

TargetFilename|endswith: .dmp
TargetFilename|contains: lsass.exe.
TargetFilename|startswith: 'C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenameends_with
  • .dmp corpus 3 (sigma 3)
TargetFilenamematch
  • lsass.exe.
TargetFilenamestarts_with
  • C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\