{"id":"6902955a-01b7-432c-b32a-6f5f81d8f625","title":"LSASS Process Dump Artefact In CrashDumps Folder","description":"Detects the presence of an LSASS dump file in the \"CrashDumps\" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.","author":"@pbssubhash","status":"test","level":"high","date":"2022-12-08","modified":"","tags":["attack.credential-access","attack.t1003.001"],"technique_ids":["T1003.001"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Rare legitimate dump of the process by the operating system due to a crash of lsass"],"references":["https://github.com/deepinstinct/Lsass-Shtinkering","https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf"],"source_path":"rules/windows/file/file_event/file_event_win_lsass_shtinkering.yml","source_sha256":"0f0c52cf5b666d98f525f785e7fba34d832476970d2c1323453f22e76c806344","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_lsass_shtinkering.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: LSASS Process Dump Artefact In CrashDumps Folder\nid: 6902955a-01b7-432c-b32a-6f5f81d8f625\nstatus: test\ndescription: Detects the presence of an LSASS dump file in the \"CrashDumps\" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.\nreferences:\n    - https://github.com/deepinstinct/Lsass-Shtinkering\n    - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf\nauthor: '@pbssubhash'\ndate: 2022-12-08\ntags:\n    - attack.credential-access\n    - attack.t1003.001\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|startswith: 'C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\CrashDumps\\'\n        TargetFilename|contains: 'lsass.exe.'\n        TargetFilename|endswith: '.dmp'\n    condition: selection\nfalsepositives:\n    - Rare legitimate dump of the process by the operating system due to a crash of lsass\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/6902955a-01b7-432c-b32a-6f5f81d8f625.json","kind":"sigma"}