Elastic Defend high stable eql

LSA Dump via Windows Error Reporting

Identifies the creation of LSASS memory crash dump via an unusual parent process. Adversaries may abuse the Windows Error Reporting service to proxy LSASS dumping as a preparation for credential access.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and process.name : ("WerFaultSecure.exe", "WerFault.exe") and
  not process.parent.executable : "?:\\Windows\\System32\\lsass.exe" and process.parent.executable != null]
 [file where event.action == "creation" and file.name : "lsass*.dmp"]

Field Validations

Loading…

Comments (0)

Loading comments...