{"id":"a18e0862-127b-43ca-be12-1a542c75c7c5","title":"LSASS Process Crashed - Application","description":"Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service).\nThis could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"experimental","level":"high","date":"2022-12-07","modified":"2025-12-03","tags":["attack.credential-access","attack.t1003.001"],"technique_ids":["T1003.001"],"logsource":{"product":"windows","service":"application"},"falsepositives":["Rare legitimate crashing of the lsass process"],"references":["https://github.com/deepinstinct/Lsass-Shtinkering","https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf","https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55"],"source_path":"rules/windows/builtin/application/application_error/win_application_error_lsass_crash.yml","source_sha256":"f31a55b823f785fa279dac2889c2a19ce766f56d14f9057f5ba78439a726e8e1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/application_error/win_application_error_lsass_crash.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: LSASS Process Crashed - Application\nid: a18e0862-127b-43ca-be12-1a542c75c7c5\nstatus: experimental\ndescription: |\n    Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service).\n    This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.\nreferences:\n    - https://github.com/deepinstinct/Lsass-Shtinkering\n    - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf\n    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-12-07\nmodified: 2025-12-03\ntags:\n    - attack.credential-access\n    - attack.t1003.001\nlogsource:\n    product: windows\n    service: application\ndetection:\n    selection:\n        Provider_Name: 'Application Error'\n        EventID: 1000\n        AppName: 'lsass.exe'\n        ExceptionCode: 'c0000001' # STATUS_UNSUCCESSFUL\n    condition: selection\nfalsepositives:\n    - Rare legitimate crashing of the lsass process\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/a18e0862-127b-43ca-be12-1a542c75c7c5.json","kind":"sigma"}