Query: write Sigma for Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Servi
Matching passage: Sigma rule: Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Servi. Logsource: windows / application. Rule: title: LSASS Process Crashed - Application id: a18e0862-127b-43ca-be12-1a542c75c7c5 status: experimental description: 'Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service). This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials. ' references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-07 modified: 2025-12-03 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: application detection: selection: Provider_Name: Application Error EventID: 1000 AppName: lsass.exe ExceptionCode: c0000001 condition: selection falsepositives: - Rare legitimate crashing of the lsass process level: high
Near-miss passage: Sigma rule: Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execu. Logsource: windows / process_creation. Rule: title: Potential Remote SquiblyTwo Technique Execution id: 8d63dadf-b91b-4187-87b6-34a1114577ea related: - id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32 type: similar - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d type: similar status: test description: 'Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution. ' references: - https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html - https://twitter.com/mattifestation/status/986280382042595328 - https://atomicredteam.io/defense-evasion/T1220/ - https://lolbas-project.github.io/lolbas/Binaries/Wmic/ - https://x.com/byrne_emmy12099/status/1932346420226658668 author: Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2019-01-16 modified: 2026-01-24 tags: - attack.stealth - attack.t1047 - attack.t1220 - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe - Hashes|contains: - IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E - IMPHASH=37777A96245A3C74EB217308F3546F4C - IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206 - IMPHASH=B12619881D79C3ACADF45E752A58554A - IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00 selection_cli: CommandLine|contains|windash: '/format:' CommandLine|contains: - :// - \\\\ condition: all of selection_* falsepositives: - Unknown level: high