name: LSASS memory dump via Windows Error Reporting
id: 7b4a74e2-c7a7-4c1f-b2ce-0e0273c3add7
version: 1.0.0
description: |
  Adversaries may abuse Windows Error Reporting service to dump LSASS memory.
  The ALPC protocol can send a message to report an exception on LSASS and
  consequently cause WER to dump the memory of the LSASS process.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1003
  technique.name: OS Credential Dumping
  technique.ref: https://attack.mitre.org/techniques/T1003/
  subtechnique.id: T1003.001
  subtechnique.name: LSASS Memory
  subtechnique.ref: https://attack.mitre.org/techniques/T1003/001/
references:
  - https://github.com/deepinstinct/Lsass-Shtinkering

condition: >
  sequence
  maxspan 2m
    |spawn_process and ps.child.name in ('WerFault.exe', 'WerFaultSecure.exe')| by ps.child.uuid
    |write_minidump_file and file.name icontains 'lsass'| by ps.uuid

min-engine-version: 2.0.0
