Potential Credential Dumping Via WER LSASS Shtinkering
Detects potential credential dumping via the Windows Error Reporting (WER) LSASS Shtinkering technique. This technique abuses WerFault.exe to dump the LSASS process memory. The rule specifically looks for WerFault.exe being executed with command-line arguments indicating a dump of a target process (-p) that is not the source process (-ip), and where the target process is likely LSASS.
Sigma
