Potential Credential Dumping via LSASS Crash (Lsass-Shtinkering)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•24

Detects Windows error reporting events where the Local Security Authority Subsystem Service (LSASS) process crashes with a specific exception code. This behavior can indicate an intentional crash, often associated with techniques like Lsass-Shtinkering, to facilitate credential dumping from LSASS memory.