Credential Dumping Attempt Via WerFault
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_process_accessed" AND PARENTPROCESSNAME endswith "\WerFault.exe" AND PROCESSNAME endswith "\lsass.exe" AND ACCESSRIGHT = "0x1FFFFF" select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PARENTPROCESSNAME,Action1.SRCUSER,Action1.TARGETUSER,Action1.CALLTRACE
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems)
