{"id":"589ac73f-8e12-409c-964e-31a2f5775ae2","title":"HackTool - WSASS Execution","description":"Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's\n(Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-23","modified":"2026-01-09","tags":["attack.credential-access","attack.t1003.001"],"technique_ids":["T1003.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://github.com/TwoSevenOneT/WSASS","https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_wsass.yml","source_sha256":"a89c3ec0cdbf22bebce8b7c578bc01157bb202259d87e44a5a767e98be6cbe45","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_wsass.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - WSASS Execution\nid: 589ac73f-8e12-409c-964e-31a2f5775ae2\nstatus: experimental\ndescription: |\n    Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's\n    (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.\nreferences:\n    - https://github.com/TwoSevenOneT/WSASS\n    - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-23\nmodified: 2026-01-09\ntags:\n    - attack.credential-access\n    - attack.t1003.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        Image|endswith: '\\wsass.exe'\n    selection_hash:\n        Hashes|contains: 'IMPHASH=32F5095C9BBDCACF28FD4060EB4DFC42'\n    selection_cli:\n        # change to |re|i after Sigma v2.0 release\n        # plain string without quotation marks as it has to match for both ' and \"\n        CommandLine|re: (?i)\\.exe[\\\"\\']?\\s+[^\\\"]{0,64}werfaultsecure\\.exe[\\\"\\']?\\s+\\d{2,10} # wsass.exe \"path to werfaultsecure\" lsass_pid\n    condition: 1 of selection_*\nfalsepositives:\n    - Unlikely\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_wsass/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/589ac73f-8e12-409c-964e-31a2f5775ae2.json","kind":"sigma"}