Credential Access via WerFault LSASS Memory Dumping

Security research and telemetry analysis indicate that adversaries are abusing the Windows Error Reporting process (WerFault.exe) to facilitate credential dumping attacks. By masquerading as or invoking legitimate error reporting workflows, attackers gain high-privilege access to the Local Security Authority Subsystem Service (LSASS) process. This technique allows for the creation of memory dumps that contain sensitive authentication material, such as NTLM hashes or plaintext credentials. Tools such as Mimikatz, NanoDump, and various PowerShell-based execution frameworks have been observed utilizing this path to bypass common monitoring. Defenders should focus on process access requests originating from WerFault.exe that target lsass.exe with full access rights.

Attack Chain

1. Attacker establishes initial access on the endpoint using a high-privilege or system-level account.
2. Attacker prepares a memory dumping utility (e.g., NanoDump or Invoke-Mimikatz).
3. Attacker triggers a memory dump operation directed at the lsass.exe process.
4. Attacker forces WerFault.exe to initialize or interact with the target process to mask the dumping activity.
5. The dumping tool leverages Windows APIs (e.g., dbghelp.dll or dbgcore.dll) to read LSASS memory.
6. The memory dump file is generated and stored locally in a temporary directory.
7. Attacker retrieves the memory dump file via C2 channels for offline credential extraction.

Impact

Successful exploitation results in the compromise of domain or local credentials stored in LSASS. This allows attackers to escalate privileges within the environment, move laterally, and maintain long-term persistence through credential re-use.

Recommendation

Deploy detection rules to monitor process access events between WerFault.exe and lsass.exe. Focus on granted access masks that indicate full control (0x1FFFFF).

• Enable Sysmon or Windows Event Log (Event ID 10) to monitor process access requests.
• Implement the provided Sigma rule in the SIEM to flag suspicious process access behavior.
• Investigate any instances where WerFault.exe initiates a high-access handle to LSASS, as this is rarely necessary for legitimate error reporting.