LoFP / unknown cases in which werfault accesses lsass.exe

Techniques

• t1003
• t1003.001

Sample rules

Credential Dumping Attempt Via WerFault

• source: sigma
• technicques:
  • t1003
  • t1003.001

Description

Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.

Detection logic

condition: selection
selection:
  GrantedAccess: '0x1FFFFF'
  SourceImage|endswith: \WerFault.exe
  TargetImage|endswith: \lsass.exe