Detectionhightest
LSASS Process Dump Artefact In CrashDumps Folder
Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event
Events for file system activity including creation, modification, and deletion.
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetFilename|startswith: 'C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\'
TargetFilename|contains: 'lsass.exe.'
TargetFilename|endswith: '.dmp'
condition: selectionFalse Positives
Rare legitimate dump of the process by the operating system due to a crash of lsass
MITRE ATT&CK
Tactics
Sub-techniques
Rule Metadata
Rule ID
6902955a-01b7-432c-b32a-6f5f81d8f625
Status
test
Level
high
Type
Detection
Created
Thu Dec 08
Author
Path
rules/windows/file/file_event/file_event_win_lsass_shtinkering.yml
Raw Tags
attack.credential-accessattack.t1003.001