Sigma rule: LSASS Process Crashed - Application

Rule

Title

LSASS Process Crashed - Application

Status

experimental

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-12-07

Modified

2025-12-03

File

rules/windows/builtin/application/application_error/win_application_error_lsass_crash.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service).
This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.

Log source

product

windows

service

application

Detection

selection:
    Provider_Name: 'Application Error'
    EventID: 1000
    AppName: 'lsass.exe'
    ExceptionCode: 'c0000001' # STATUS_UNSUCCESSFUL
condition: selection

False positives (as the rule lists them)

• Rare legitimate crashing of the lsass process

Tags

• attack.credential-access
• attack.t1003.001

MITRE ATT&CK ids this rule names

• T1003.001

References

• https://github.com/deepinstinct/Lsass-Shtinkering
• https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
• https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/application/application_error/win_application_error_lsass_crash.yml