LSASS Process Dump Artefact In CrashDumps Folder — Sigma Rule

Rule metadata and linked tags

Author: @pbssubhash. Source status: test; severity: high. Source dates: 2022-12-08 / not supplied.

{
  "product": "windows",
  "category": "file_event"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 0f0c52cf5b666d98f525f785e7fba34d832476970d2c1323453f22e76c806344

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: LSASS Process Dump Artefact In CrashDumps Folder
id: 6902955a-01b7-432c-b32a-6f5f81d8f625
status: test
description: Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.
references:
    - https://github.com/deepinstinct/Lsass-Shtinkering
    - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
author: '@pbssubhash'
date: 2022-12-08
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|startswith: 'C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\'
        TargetFilename|contains: 'lsass.exe.'
        TargetFilename|endswith: '.dmp'
    condition: selection
falsepositives:
    - Rare legitimate dump of the process by the operating system due to a crash of lsass
level: high

Original YAML and metadata in JSON

False positives

• Rare legitimate dump of the process by the operating system due to a crash of lsass

Source references

• https://github.com/deepinstinct/Lsass-Shtinkering
• https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf