HackTool - WSASS Execution

SigmaHQ Detections@sigmaHQ

•updated Mar 19, 2026•0•0•0

Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.