Rule Info
Name
HackTool - WSASS Execution
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's
(Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.
Reference
Date
2025-11-23 00:00:00
Modified
None
Id
589ac73f-8e12-409c-964e-31a2f5775ae2
Tags
attack.credential-access attack.t1003.001
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR