LSASS Process Crashed - Application

Title: LSASS Process Crashed - Application
Status: experimental
Description:Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service). This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.
References:
  -https://github.com/deepinstinct/Lsass-Shtinkering
  -https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
  -https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-07
modified:2025-12-03
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• product: windows
• service: application

Detection:
  selection:
    Provider_Name: 'Application Error'
    EventID: '1000'
    AppName: 'lsass.exe'
    ExceptionCode: 'c0000001'
  condition:selection
Falsepositives:
  -Rare legitimate crashing of the lsass process
Level: high