{"id":"9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3","title":"Potential Credential Dumping Via WER","description":"Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass","author":"@pbssubhash , Nasreddine Bencherchali","status":"test","level":"high","date":"2022-12-08","modified":"2022-12-09","tags":["attack.credential-access","attack.t1003.001"],"technique_ids":["T1003.001"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Windows Error Reporting might produce similar behavior. In that case, check the PID associated with the \"-p\" parameter in the CommandLine."],"references":["https://github.com/deepinstinct/Lsass-Shtinkering","https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf"],"source_path":"rules/windows/process_creation/proc_creation_win_werfault_lsass_shtinkering.yml","source_sha256":"437f66f2de963fcdf7f500c287a3cc5e771c3b9c86f917f0b616ac3e904cab7d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_werfault_lsass_shtinkering.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Credential Dumping Via WER\nid: 9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3\nstatus: test\ndescription: Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass\nreferences:\n    - https://github.com/deepinstinct/Lsass-Shtinkering\n    - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf\nauthor: '@pbssubhash , Nasreddine Bencherchali'\ndate: 2022-12-08\nmodified: 2022-12-09\ntags:\n    - attack.credential-access\n    - attack.t1003.001\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_img:\n        - Image|endswith: '\\Werfault.exe'\n        - OriginalFileName: 'WerFault.exe'\n    selection_cli:\n        ParentUser|contains: # covers many language settings\n            - 'AUTHORI'\n            - 'AUTORI'\n        User|contains:\n            - 'AUTHORI'\n            - 'AUTORI'\n        CommandLine|contains|all:\n            # Doc: WerFault.exe -u -p <target process> -ip <source process> -s <file mapping handle>\n            # Example: C:\\Windows\\system32\\Werfault.exe -u -p 744 -ip 1112 -s 244\n            # If the source process is not equal to the target process and the target process is LSASS then this is an indication of this technique\n            # Example: If the \"-p\" points the PID of \"lsass.exe\" and \"-ip\" points to a different process than \"lsass.exe\" then this is a sign of malicious activity\n            - ' -u -p '\n            - ' -ip '\n            - ' -s '\n    filter_lsass:\n        ParentImage: 'C:\\Windows\\System32\\lsass.exe'\n    condition: all of selection_* and not 1 of filter_*\nfalsepositives:\n    - Windows Error Reporting might produce similar behavior. In that case, check the PID associated with the \"-p\" parameter in the CommandLine.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/9a4ccd1a-3526-4d99-b980-9f9c5d3a6ff3.json","kind":"sigma"}