WerFault LSASS Process Memory Dump

Title: WerFault LSASS Process Memory Dump
Status: test
Description:Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials
References:
  -https://github.com/helpsystems/nanodump
Author: Florian Roth (Nextron Systems)
Date: 2022-06-27
modified:None
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    Image: 'C:\WINDOWS\system32\WerFault.exe'
    TargetFilename|contains:
      -'\lsass'
      -'lsass.exe'

  condition:selection
Falsepositives:
  -Unknown
Level: high