Attack Chain

1. An attacker gains initial access to the target system (details not specified in source).
2. The attacker deploys the WSASS tool to the compromised system.
3. The attacker executes WSASS with the path to WerFaultSecure.exe and the LSASS process ID as command-line arguments (e.g., wsass.exe "path to werfaultsecure" lsass_pid).
4. WSASS leverages WER's WerFaultSecure.exe to bypass PPL protections.
5. WerFaultSecure.exe is used to gain access to the LSASS process memory.
6. WSASS dumps the LSASS memory contents to a file or other storage location.
7. The attacker retrieves the dumped LSASS memory file.
8. The attacker parses the dumped LSASS memory for credentials and other sensitive information.

Impact

Successful execution of WSASS and subsequent LSASS memory dumping can lead to the theft of sensitive credentials, including user passwords, Kerberos tickets, and NTLM hashes. This can allow attackers to move laterally within the network, escalate privileges, and gain access to critical systems and data. The impact can range from data breaches and financial loss to reputational damage and disruption of services. Organizations across all sectors that rely on Windows systems are potentially vulnerable.

Recommendation

• Deploy the Sigma rule HackTool - WSASS Execution to your SIEM and tune it for your environment to detect the execution of WSASS based on image name, hash, and command-line arguments.
• Monitor process creation events for executions of wsass.exe using the process_creation log source.
• Investigate any process execution where a process calls WerFaultSecure.exe with a PID as a command-line argument, especially if wsass.exe is involved, to identify potential credential access attempts.